CVE-2022-25767
CRITICALUreport2 - Insecure Deserialization
Title source: ruleDescription
All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database server, causing arbitrary file read and deserialization of local gadgets.
Scores
CVSS v3
9.8
EPSS
0.0311
EPSS Percentile
86.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-502
Status
published
Affected Products (2)
ureport2_project/ureport2
com.bstek.ureport/ureport2-console
Maven
Timeline
Published
May 01, 2022
Tracked Since
Feb 18, 2026