CVE-2022-47878: jedox — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2022-47878

CVSS 8.8 · High EPSS 35,7%

Kerentanan Unrestricted Upload of File with Dangerous Type pada jedox. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify the location as Webroot directory. Consecutive file uploads can lead to the execution of arbitrary code. NOTE: The vendor states that the vulnerability affects installations running version 22.2 or earlier. The issue was resolved with the version 22.3 and later versions are not affected. Additionally, the vendor states that this vulnerability affects on-premises deployments only and that it does not impact cloud-hosted or SaaS environments.

Rincian

Terbit di NVD: 2 Mei 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 35,7% peluang dieksploitasi; lebih tinggi dari 98,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jedox	jedox	Versi 2020.2.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://packetstormsecurity.com/files/172154/Jedox-2020.2.5-Configurable-Storage-Path-Remote-Code-Execution.htm... exploit · advisory pihak ketiga · vdb entry
https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf exploit · advisory pihak ketiga
https://jedox.mantishub.io/app/issues/57238

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.