Authentication flaw

2023-12-2508:15:00

PRIOn knowledge base

www.prio-n.com

rws worldserver

authentication bypass

arbitrary code execution

java

.jar archive

api endpoint

7.5 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

43.5%

JSON

An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.

CPENameOperatorVersion
worldserverlt11.7.3

CPE	Name	Operator	Version
	worldserver	lt	11.7.3

References

www.rws.com/localization/products/trados-enterprise/worldserver/

www.triskelelabs.com/vulnerabilities-in-rws-worldserver