Actively exploited · Published Aug 26, 2022 · Assigned by mitre
CVE-2022-36537
High 7.5 Exploited Ransomware
In plain English
A high-severity security flaw in AuUploader from ZK Framework. Attackers are actively exploiting it in the wild (listed by CISA on February 27, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 95.4% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 20, 2023.
Official description
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.zkoss.zk:zk | 8.6.4.2 | GHSA-6278-2q4m-cmf3 |
| Maven | org.zkoss.zk:zk | 9.0.1.3 | GHSA-6278-2q4m-cmf3 |
| Maven | org.zkoss.zk:zk | 9.5.1.4 | GHSA-6278-2q4m-cmf3 |
| Maven | org.zkoss.zk:zk | 9.6.0.2 | GHSA-6278-2q4m-cmf3 |
| Maven | org.zkoss.zk:zk | 9.6.2 | GHSA-6278-2q4m-cmf3 |