ZK Framework AuUploader Unspecified Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 27/02/2023. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.zkoss.zk:zk | ≥ 9.0.0.0, < 9.0.1.3≥ 9.5.0.0, < 9.5.1.4≥ 9.6.0.0, < 9.6.0.2≥ 9.6.1, < 9.6.2< 8.6.4.2 | 9.0.1.39.5.1.49.6.0.29.6.28.6.4.2 |
| zk framework | ≥ 9.0.0, < 9.0.1.3≥ 9.5.0, < 9.5.1.3≥ 9.6.0, < 9.6.2< 8.6.4.2 | 9.0.1.39.5.1.39.6.28.6.4.2 |
ZK Framework version 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free