Main Vulnerability Database Vulnerabilities #VU69264

Input validation error in TERASOLUNA Server Framework for Java (Rich) and TERASOLUNA Global Framework - CVE-2022-43484

Published: November 14, 2022

Vulnerability identifier: #VU69264

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-43484

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input in the binding mechanism of Spring MVC. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the system.

Affected software

TERASOLUNA Server Framework for Java (Rich)
TERASOLUNA Global Framework

How to mitigate CVE-2022-43484

Install updates from vendor's website.

TERASOLUNA Server Framework for Java (Rich) - update to 2.0.6.1
TERASOLUNA Global Framework - update to 1.0.1

External References

Related Security Bulletins