Description
kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted with a hardcoded key from the com.kalvin.kvf.common.shiro.ShiroConfig file.
Unscored
CVE-2022-35857
EUVD-2022-38730GHSA-h775-wq88-p3f2
kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parame…
Published Jul 13, 2022 · Updated Aug 3, 2024 · Assigned by mitre