PT-2023-14939 · Datax-Web · Datax-Web
CVE-2022-46478
·
Publicado
2023-01-13
·
Atualizado
2023-01-23
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
datax-web versions 1.0.0 through 2.1.2
Description
The issue concerns the RPC interface in datax-web, which lacks permission checks by default. This allows attackers to execute arbitrary commands by sending crafted Hessian serialized data.
Recommendations
For versions 1.0.0 through 2.1.2, consider implementing permission checks for the RPC interface to prevent unauthorized access and command execution. As a temporary workaround, restrict access to the RPC interface until a proper fix is applied.
Exploit
Correção
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Datax-Web