ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive
    information via a crafted POST request sent to the component AuUploader. (CVE-2022-36537)

The version of Potix ZK Framework detected on the remote host is prior to 8.6.4.2, 9.0.1.3, 9.5.1.4, 9.6.0.2, or 9.6.2.
If is, therefore, affected by a remote file disclosure vulnerability:

  - ZK Framework allows attackers to access sensitive information via a crafted POST request sent to the component     AuUploader. (CVE-2022-36537)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ZK is a popular Java Web framework for building enterprise Web applications. By forging a POST request to the AuUpload ZK serverlets, an unauthenticated attacker can retrieve the content of a file located in the web context.

ID	Name	Product	Family	Severity
411107	SCA: security update for org.zkoss.zk:zk (GHSA-6278-2q4m-cmf3)	Tenable Cloud Security	SCA Checks	high
411107	SCA: security update for org.zkoss.zk:zk (GHSA-6278-2q4m-cmf3)	Tenable Self-Hosted Container Security	SCA Checks	high
184458	Potix ZK Framework AuUploader Remote File Disclosure (CVE-2022-36537)	Nessus	Misc.	high
113643	ZK Framework < 8.6.4.2 / 9.0.x < 9.0.1.3 / 9.5.x < 9.5.1.4 / 9.6.0.x < 9.6.0.2 / 9.6.x < 9.6.2 Authentication Bypass	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2022-36537

high

Tenable Plugins

high

high

high

high