CVE-2022-36537

Published: Aug 26, 2022Modified: Jun 17, 2026CISA KEV

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

Affected (4)

Products: Zkoss: Zk Framework

Zkoss

1 product

Zk Framework

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Zkoss Zk Framework	Before 8.6.4.2
Zkoss Zk Framework	From 9.0.0 to 9.0.1.3
Zkoss Zk Framework	From 9.5.0 to 9.5.1.3
Zkoss Zk Framework	From 9.6.0 to 9.6.2

References (5)

https://tracker.zkoss.org/browse/ZK-5150

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/

Source: cve@mitre.org

Third Party Advisory

https://tracker.zkoss.org/browse/ZK-5150

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36537

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.