PT-2023-15510 · Jedox · Jedox

Published 2023-05-02 · Updated 2025-11-06 · CVE-2022-47878

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jedox version 2020.2.5

Description The issue is related to incorrect input validation for the default-storage-path in the settings page, allowing remote, authenticated users to specify the location as the Webroot directory. This can lead to the execution of arbitrary code through consecutive file uploads.

Recommendations For Jedox version 2020.2.5, consider disabling the settings page or restricting access to the default-storage-path configuration to minimize the risk of exploitation. Avoid using the default-storage-path feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-47878

Affected Products

Jedox

References · 10

• 🔥 http://packetstormsecurity.com/files/172154/Jedox-2020.2.5-Configurable-Storage-Path-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/51426 · Exploit
• 🔥 https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-47878 · Security Note
• https://osv.dev/vulnerability/CVE-2022-47878 · Vendor Advisory
• https://jedox.mantishub.io/app/issues/57238 · Note
• https://t.me/cveNotify/141865 · Telegram Post
• https://t.me/cibsecurity/63174 · Telegram Post
• https://t.me/cvenotify/109192 · Telegram Post
• https://t.me/cveNotify/141919 · Telegram Post