Critical severity9.8NVD Advisory· Published Dec 1, 2022· Updated Jun 17, 2026
CVE-2022-36431
CVE-2022-36431
Description
An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1.
Affected products
3- Rocket/TRUfusion Enterprisedescription
- Range: <7.9.6.1
Patches
Vulnerability mechanics
References
2- www.synacktiv.com/sites/default/files/2022-11/trufusion_enterprise_unauthenticated_arbitrary_file_write.pdfnvdExploitThird Party Advisory
- docs.rocketsoftware.com/bundle/TRUfusionEnterprise_ReleaseNotes_V7.9.6.1/resource/TRUfusionEnterprise_ReleaseNotes_V7.9.6.1.pdfnvdRelease NotesVendor Advisory
News mentions
0No linked articles in our index yet.