CVE-2022-35857: kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted…

PriorityP355critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.40%

69.0th percentile

kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted with a hardcoded key from the com.kalvin.kvf.common.shiro.ShiroConfig file.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
kvf-admin_project	kvf-admin	<= 2022-02-12	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.