CVE-2022-46478
The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary comman...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- report github.com