CVE-2022-41711
published 2022-10-25CVE-2022-41711: Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.55%
72.0th percentile
Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| badaso | core | >= 0 < 2.6.1 | 2.6.1 |
| uatech | badaso | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Badaso vulnerable to Remote Code Execution via malicious file upload
osv·2022-10-26
CVE-2022-41711 [CRITICAL] Badaso vulnerable to Remote Code Execution via malicious file upload
Badaso vulnerable to Remote Code Execution via malicious file upload
Badaso allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
GHSA
Badaso vulnerable to Remote Code Execution via malicious file upload
ghsa·2022-10-26
CVE-2022-41711 [CRITICAL] CWE-434 Badaso vulnerable to Remote Code Execution via malicious file upload
Badaso vulnerable to Remote Code Execution via malicious file upload
Badaso allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-10-25
Published