CVE-2022-41705
published 2022-11-25CVE-2022-41705: Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.81%
76.0th percentile
Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| badaso | core | >= 0 < 2.7.0 | 2.7.0 |
| uatech | badaso | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Badaso vulnerable to Remote Code Execution (RCE)
ghsa·2022-11-25
CVE-2022-41705 [CRITICAL] CWE-434 Badaso vulnerable to Remote Code Execution (RCE)
Badaso vulnerable to Remote Code Execution (RCE)
Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
OSV
Badaso vulnerable to Remote Code Execution (RCE)
osv·2022-11-25
CVE-2022-41705 [CRITICAL] Badaso vulnerable to Remote Code Execution (RCE)
Badaso vulnerable to Remote Code Execution (RCE)
Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-25
Published