CVE-2022-34269

An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/loaddtd?systemid= blind SSRF attack to deploy JSP code to the Apache Axis service running on the localhost interface, leading to command execution...

CVE-2022-34269

An authenticated, remote attacker can exploit a blind SSRF vulnerability in RWS WorldServer versions prior to 11.7.3 . By utilizing the ws-legacy/load_dtd?system_id= endpoint, the attacker can deploy JSP code to the Apache Axis service running on the localhost interface, which can result in comma...