PT-2023-14939 · Datax-Web · Datax-Web

Published 2023-01-13 · Updated 2023-01-23 · CVE-2022-46478

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions datax-web versions 1.0.0 through 2.1.2

Description The issue concerns the RPC interface in datax-web, which lacks permission checks by default. This allows attackers to execute arbitrary commands by sending crafted Hessian serialized data.

Recommendations For versions 1.0.0 through 2.1.2, consider implementing permission checks for the RPC interface to prevent unauthorized access and command execution. As a temporary workaround, restrict access to the RPC interface until a proper fix is applied.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-46478

Affected Products

Datax-Web

References · 3

• 🔥 https://github.com/WeiYe-Jing/datax-web/issues/587 · Exploit
• https://osv.dev/vulnerability/CVE-2022-46478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46478 · Security Note