{"id":"CVE-2022-36537","kind":"vulnerability","aliases":["CVE-2022-36537"],"related":[],"title":"zkoss zk framework: ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a…","description":"ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.\n\nCISA required action: Apply updates per vendor instructions.","summary":"The ZK Framework's AuUploader servlet has an unspecified flaw that lets an attacker read files from the web application's context. It is on CISA's known-exploited list, and ransomware use is reported in the tags.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2023-02-27T00:00:00+00:00","products":[{"name":"ZK Framework AuUploader","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"zkoss zk framework","fixed":["8.6.4.2"],"affected":"< 8.6.4.2","ecosystem":"vendor"},{"name":"zkoss zk framework","fixed":["9.0.1.3"],"affected":">= 9.0.0, < 9.0.1.3","ecosystem":"vendor"},{"name":"zkoss zk framework","fixed":["9.5.1.3"],"affected":">= 9.5.0, < 9.5.1.3","ecosystem":"vendor"},{"name":"zkoss zk framework","fixed":["9.6.2"],"affected":">= 9.6.0, < 9.6.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["connectwise-r1soft","exploited","java","package","ransomware","self-hosted","zk-framework"],"not_affected_if":["no-auuploader-servlet","no-zk-framework"],"how_to_check":"Check whether your Java app depends on org.zkoss:zk and whether any ZK AuUploader servlet is deployed, for example in WEB-INF/web.xml or the app's lib directory.","fix":"Apply the vendor update per CISA guidance; the sources do not give a fixed version.","status":"open","published_at":"2022-08-26T20:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:36+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-23T21:08:36Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per CISA guidance; the sources do not give a fixed version.\nunknown","reach":"internet","impact":"medium","summary":"The ZK Framework's AuUploader servlet has an unspecified flaw that lets an attacker read files from the web application's context. It is on CISA's known-exploited list, and ransomware use is reported in the tags.","category":"package","who_cares":["java","zk-framework","connectwise-r1soft","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads arbitrary files from the web application context","analyst_note":"Find the fixed ZK and R1Soft versions and the AuUploader servlet config from the vendor advisory; the CISA KEV entry only says apply vendor updates.","how_to_check":"Check whether your Java app depends on org.zkoss:zk and whether any ZK AuUploader servlet is deployed, for example in WEB-INF/web.xml or the app's lib directory.\nunknown","needs_analyst":true,"not_affected_if":["no-zk-framework","no-auuploader-servlet"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000498,"input_tokens":2856,"output_tokens":424,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':20A,23A '-36537':21A,24A '8.6.4.1':11A '9.0.1.2':9A '9.5.1.3':8A '9.6.0.1':7A 'access':15A 'action':145C 'allow':12A,102C 'appli':146C 'applic':72B 'attack':13A,66B,104C 'auupload':57B,94C 'auuploader':27A 'backup':141C 'cisa':78B,143C 'connectwis':41B,138C 'connectwise-r1soft':40B 'contain':96C 'content':108C 'context':74B,116C 'could':101C 'cve':19A,22A 'exploit':43B,82B 'file':68B,111C 'flaw':62B 'framework':3A,5A,26A,30A,33A,36A,39A,52B,55B,93C,119C,126C 'host':49B 'impact':130C 'includ':133C 'inform':17A 'instruct':150C 'java':44B,125C 'known':81B 'known-exploit':80B 'let':64B 'limit':136C 'list':83B 'locat':112C 'manag':142C 'multipl':131C 'open':123C 'open-sourc':122C 'packag':45B 'per':148C 'product':132C 'r1soft':42B,139C 'ransomwar':46B,85B 'read':67B 'report':88B 'requir':144C 'retriev':106C 'self':48B 'self-host':47B 'sensit':16A 'server':140C 'servlet':58B,95C 'sourc':124C 'tag':91B 'unspecifi':61B,98C 'updat':147C 'use':86B 'v9.6.1':6A 'vendor':149C 'via':18A 'vulner':99C,128C 'web':71B,115C 'zk':2A,4A,25A,29A,32A,35A,38A,51B,54B,92C,118C 'zk-framework':50B 'zkoss':1A,28A,31A,34A,37A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-08-26T20:15:08+00:00","kev":{"dateAdded":"2023-02-27","dueDate":"2023-03-20","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-36537","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-36537","severity":null,"published_at":"2023-02-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T17:39:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-36537","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36537","severity":null,"published_at":"2022-08-26T20:15:08+00:00","modified_at":"2026-06-17T04:53:38+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}