{"id":"CVE-2022-36537","details":"ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.","aliases":["GHSA-6278-2q4m-cmf3"],"modified":"2026-08-18T14:36:48.493955Z","published":"2022-08-26T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36537.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://tracker.zkoss.org/browse/ZK-5150"},{"type":"WEB","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36537"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36537.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36537"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zkoss/zk","events":[{"introduced":"0"},{"fixed":"4271cf0b0a9a1686fafc43af169bc3768f57cba0"},{"introduced":"6c6f10ad57143191b1fb21c1794cbabc504a858c"},{"fixed":"9b0d586e384f0962798ece209dcf30ccd9cc35f3"},{"introduced":"9ed43004a2cf446d06f6003969b8807339e829b1"},{"fixed":"901c4a647002475d126fda878f4b3bbb2290fba9"},{"introduced":"d37dc80e9414849536f12d41b5ef766d02058046"},{"fixed":"fa2007a98b562012b42734def9373f1d5e456897"}],"database_specific":{"cpe":"cpe:2.3:a:zkoss:zk_framework:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.6.4.2"},{"introduced":"9.0.0"},{"fixed":"9.0.1.3"},{"introduced":"9.5.0"},{"fixed":"9.5.1.3"},{"introduced":"9.6.0"},{"fixed":"9.6.2"}],"source":"CPE_RANGE"}}],"versions":["v9.0.1.2","v8.6.4.1","v9.5.1.2","v9.5.1.1","v9.5.1","v8.6.4","v8.6.3","v8.5.0","v9.0.1.1","v9.0.1","v8.6.2","v8.6.0","v8.5.2","v8.5.1","v8.0.4.2","v8.0.4.1","v8.0.4","v8.0.3","v8.0.2","v8.0.1","v8.0.0","v8.0.EL.2.2","v7.0.4","v7.0.3","v7.0.2","v7.0.0","v7.0.0-RC","v7.0.0-Preview","v6.5.2","v6.5.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-36537.json","vanir_signatures_modified":"2026-08-18T14:36:48Z","vanir_signatures":[{"target":{"file":"zk/src/org/zkoss/zk/Version.java"},"deprecated":false,"digest":{"line_hashes":["117576616078778999642976925321291918973","333628973242060767816104327271779652870"],"threshold":0.9},"id":"CVE-2022-36537-291c1c74","signature_type":"Line","signature_version":"v1","source":"https://github.com/zkoss/zk/commit/4271cf0b0a9a1686fafc43af169bc3768f57cba0"},{"target":{"file":"zk/src/org/zkoss/zk/Version.java"},"deprecated":false,"digest":{"line_hashes":["65590753180256321531435750335816438997","149143847992644947948913359545227319018"],"threshold":0.9},"id":"CVE-2022-36537-3a076a92","signature_type":"Line","signature_version":"v1","source":"https://github.com/zkoss/zk/commit/fa2007a98b562012b42734def9373f1d5e456897"},{"source":"https://github.com/zkoss/zk/commit/9b0d586e384f0962798ece209dcf30ccd9cc35f3","target":{"file":"zk/src/org/zkoss/zk/Version.java"},"deprecated":false,"digest":{"line_hashes":["7365089467909330125349943113272355522","47332037741835786028406970016400998198"],"threshold":0.9},"id":"CVE-2022-36537-8f60720d","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["137711726433433016033059931372245228343","202631413215551158619460968328017010123"],"threshold":0.9},"id":"CVE-2022-36537-a081c810","signature_type":"Line","signature_version":"v1","source":"https://github.com/zkoss/zk/commit/901c4a647002475d126fda878f4b3bbb2290fba9","target":{"file":"zk/src/org/zkoss/zk/Version.java"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}