CVE-2022-34268

2023-12-2500:00:00

mitre

www.cve.org

vulnerability

rws worldserver

command execution

deserialization

java objects

authentication

AI Score

9.8

Confidence

High

EPSS

0.001

Percentile

49.9%

JSON

An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.

References

www.rws.com/localization/products/trados-enterprise/worldserver/

www.triskelelabs.com/vulnerabilities-in-rws-worldserver