CVE-2022-22916

Deeper analysis

O2OA version 6.4.7 contains a remote code execution vulnerability that can be triggered through the endpoint /x_program_center/jaxrs/invoke. The flaw received a CVSS 3.1 score of 9.8, reflecting network-accessible attack conditions that require no authentication or user interaction and that can result in full confidentiality, integrity, and availability impact.

An unauthenticated remote attacker can send crafted requests to the affected endpoint and execute arbitrary code on the server, leading to complete system compromise. Public proof-of-concept code demonstrating the issue has been published, and the current EPSS score of 0.9019 indicates a high likelihood of exploitation attempts.

The referenced materials point only to the vendor site and exploit artifacts; they contain no details on official patches, workarounds, or mitigation steps. The consistently high EPSS value since disclosure shows sustained exploitation interest rather than a later surge.