CVE-2022-36215
Published: 17 August 2022
Summary
CVE-2022-36215 is a high-severity an unspecified weakness vulnerability in Dedebiz Dedecmsv6. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
DedeBIZ version 6 contains a remote code execution vulnerability located in the sys_info.php component. The flaw received a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, and requirements for high privileges, with impacts to confidentiality, integrity, and availability all rated high.
An authenticated administrator can exploit the issue over the network to execute arbitrary code on the underlying server, resulting in complete system compromise. No user interaction is required once administrative credentials are obtained.
Public proof-of-concept material has been posted to GitHub demonstrating the flaw, but the supplied references contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained flat at 0.1544 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38934
Vulnerability details
DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.