Remote Code Execution Vulnerability in kvf-admin by Kalvin
CVE-2022-35857

9.8CRITICAL

Key Information:

Vendor

Kvf-admin Project

Status
Kvf-admin
Vendor
CVE Published:
13 July 2022

What is CVE-2022-35857?

The kvf-admin application is vulnerable to a serious deserialization flaw that allows remote attackers to execute arbitrary code. This vulnerability is due to improper handling of the rememberMe parameter, which is encrypted using a hardcoded key found in the com.kalvin.kvf.common.shiro.ShiroConfig file. Exploiting this weakness can lead to severe security breaches, as attackers may gain full control over the affected system.

References

https://github.com/kalvinGit/kvf-admin/issues/16
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.