蓝凌 OA CVE-2022-34924 任意文件读取漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-34924
• https://avd.aliyun.com/detail?id=AVD-2022-34924
• https://vuldb.com/zh/?id=205535
• https://vulners.com/search/vendors/landray/products/landray%20office%20automation
• https://www.rainforest.tech/cves/CVE-2022-34924.html
• https://stack.watch/vuln/CVE-2022-34924/
• https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2022-34924
• https://github.com/advisories/GHSA-5r46-4f86-pmc5
• https://feedly.com/cve/CVE-2022-34924
• https://scm.cms.hu-berlin.de/safeguarding/cvelistV5/-/blob/458607d64787ea7f5e693e2bc96f5c5c1772a371/cves/2022/34xxx/CVE-2022-34924.json
• https://www.sxcast.edu.cn/uploadfile/ueditor/file/202510/1761869308d5a4ea.pdf
• https://www.6cloudtech.com/portal/article/index/id/1053.html

Related Vulnerabilities

• 蓝凌OA /WS/Basic/Basic.asmx WS_getAllInfos 信息泄露漏洞
• PoC蓝凌OA /sys/zone/sys_zone_personInfo/sysZonePersonInfo.do 信息泄露漏洞
• 蓝凌OA /sys/ui/sys_ui_component/sysUiComponent.do 命令执行漏洞
• 蓝凌OA /ekp/data/sys-common/dataxml.tmpl 命令执行漏洞
• 蓝凌 OA /sys/ui/extend/varkind/custom.jsp XMLDecoder 代码执行漏洞
• 蓝凌OA /sys/webservice/elecPsealUseWebService 文件读取漏洞
• 蓝凌OA /sys/webservice/sysNotifyTodoWebServiceEkpj 文件读取漏洞
• 蓝凌OA /sys/webservice/loginWebserviceService 文件读取漏洞