← Database

CVE-2022-46478

CRITICAL CVSS: 9.8 Published: 2023-01-13 Modified: 2026-06-17

Description

The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data.

Affected Platforms

Datax-Web Project Datax-Web

Weakness Type

CWE-502, CWE-502

References