Unrated severityNVD Advisory· Published Dec 1, 2022· Updated Apr 24, 2025

CVE-2022-36431

Description

An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted JSP file. Issue fixed in version 7.9.6.1.

Affected products

Rocket/TRUfusion Enterprisedescription
Rocketsoftware/Trufusion Enterprisellm-fuzzy
Range: <7.9.6.1

Patches

Vulnerability mechanics

References

docs.rocketsoftware.com/bundle/TRUfusionEnterprise_ReleaseNotes_V7.9.6.1/resource/TRUfusionEnterprise_ReleaseNotes_V7.9.6.1.pdfmitre
www.synacktiv.com/sites/default/files/2022-11/trufusion_enterprise_unauthenticated_arbitrary_file_write.pdfmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000