CVE-2022-35223

EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload will trigger this insecure deserialization vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code, manipulate system command or interrupt service.

Score

CVSS 3.1 9.8 Critical

Status

Modified - twcert@cert.org.tw

Published

2022-08-02

Last modified

2024-09-17

Weaknesses

CWE-502

Affected products

• Mailhunter Ultimate (Easyuse)

References

• https://www.chtsecurity.com/news/a381467e-74ff-4a8c-a4d3-fc86720f5400
• https://www.twcert.org.tw/tw/cp-132-6365-b056c-1.html