Vulnerability Description
An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rws | Worldserver | < 11.7.3 |
Related Weaknesses (CWE)
References
- https://www.rws.com/localization/products/trados-enterprise/worldserver/Product
- https://www.triskelelabs.com/vulnerabilities-in-rws-worldserverExploitThird Party Advisory
- https://www.rws.com/localization/products/trados-enterprise/worldserver/Product
- https://www.triskelelabs.com/vulnerabilities-in-rws-worldserverExploitThird Party Advisory
FAQ
What is CVE-2022-34267?
CVE-2022-34267 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a...
How severe is CVE-2022-34267?
CVE-2022-34267 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-34267?
Check the references section above for vendor advisories and patch information. Affected products include: Rws Worldserver.