PT-2022-21961 · Unit4 · Unit4 Erp

Alexis Vanden Eijnde · Published 2022-07-19 · Updated 2022-07-27 · CVE-2022-34001

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Unit4 ERP versions through 7.9

Description The issue allows XXE (XML External Entity) attacks via the ExecuteServerProcessAsynchronously function. This can potentially lead to unauthorized access to sensitive data.

Recommendations For versions through 7.9, consider disabling the ExecuteServerProcessAsynchronously function as a temporary workaround until a patch is available. Restrict access to sensitive data and modules that utilize this function to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-34001

Affected Products

Unit4 Erp

References · 4

• 🔥 https://prisminfosec.com/cve-2022-34001 · Exploit
• https://osv.dev/vulnerability/CVE-2022-34001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34001 · Security Note
• https://t.me/cibsecurity/46559 · Telegram Post