CVE-2022-36537

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-36537
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://tracker.zkoss.org/browse/ZK-5150 Issue Tracking Patch Vendor Advisory
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/ Third Party Advisory
https://tracker.zkoss.org/browse/ZK-5150 Issue Tracking Patch Vendor Advisory
https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/ Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36537
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:zkoss:zk_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:*:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:*:*:*:*:*:*:*:*
History

22 Oct 2025, 00:18

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36537 -

21 Oct 2025, 20:19

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36537', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:19

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36537 -

21 Nov 2024, 07:13

Type Values Removed Values Added
References () https://tracker.zkoss.org/browse/ZK-5150 - Issue Tracking, Patch, Vendor Advisory () https://tracker.zkoss.org/browse/ZK-5150 - Issue Tracking, Patch, Vendor Advisory
References () https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/ - Third Party Advisory () https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/ - Third Party Advisory

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE CWE-200 NVD-CWE-Other

03 Mar 2023, 18:52

Type Values Removed Values Added
References (MISC) https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/ - (MISC) https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/ - Third Party Advisory
CPE cpe:2.3:a:zkoss:zk_framework:9.6.1:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:9.5.1.3:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:8.6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:9.0.1.2:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:9.6.0.1:*:*:*:*:*:*:*		 cpe:2.3:a:zkoss:zk_framework:*:*:*:*:*:*:*:*

28 Feb 2023, 22:15

Type Values Removed Values Added
References
  • (MISC) https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/ -

01 Sep 2022, 19:24

Type Values Removed Values Added
CPE cpe:2.3:a:zkoss:zk_framework:9.0.1.2:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:8.6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:9.5.1.3:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:9.6.1:*:*:*:*:*:*:*
cpe:2.3:a:zkoss:zk_framework:9.6.0.1:*:*:*:*:*:*:*
References (MISC) https://tracker.zkoss.org/browse/ZK-5150 - (MISC) https://tracker.zkoss.org/browse/ZK-5150 - Issue Tracking, Patch, Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-200

26 Aug 2022, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-08-26 20:15

Updated : 2025-10-22 00:18

NVD link : CVE-2022-36537

Mitre link : CVE-2022-36537

CVE.ORG link : CVE-2022-36537

JSON object : View

Products Affected

zkoss

  • zk_framework
CWE
NVD-CWE-Other