Unquoted Search Path or Element in JustSystems JUST Online Update for J-License

1) Unquoted Search Path or Element

EUVDB-ID: #VU65837

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-36344

CWE-ID: CWE-428 - Unquoted Search Path or Element

Exploit availability: No

Description

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to an unquoted service path. A local user can execute arbitrary file with the privilege of the Windows service.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

JUST Online Update for J-License: All versions

CPE2.3

• cpe:2.3:a:justsystems_corporation:just_online_update_for_j-license:*:*:*:*:*:*:*:*

External links

https://jvn.jp/en/jp/JVN57073973/index.html
https://www.justsystems.com/jp/corporate/info/js22001.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.