Critical · 9.8 CVE-2022-34268 EUVD-2022-37229GHSA-q565-26vc-vpx8

An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command…

Published Dec 25, 2023 · Updated Sep 9, 2024 · Assigned by mitre

Description

An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.

References

https://www.rws.com/localization/products/trados-enterprise/worldserver/
https://www.triskelelabs.com/vulnerabilities-in-rws-worldserver