CVE-2022-50992— Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-50992
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet
Source: NVD (National Vulnerability Database)
Vulnerability Description
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods. Attackers can exploit these methods without authentication to retrieve sensitive files including system configuration files and database credentials from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-12-14 (UTC).
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Weaver E-cology 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Weaver E-cology是中国泛微（Weaver）公司的一个协同管理平台。 Weaver E-cology 9.5 10.52之前版本存在路径遍历漏洞，该漏洞源于XmlRpcServlet接口的XML-RPC端点存在任意文件读取漏洞，允许未经身份验证的远程攻击者通过向WorkflowService.getAttachment和WorkflowService.LoadTemplateProp方法提供文件路径来读取任意文件，包括系统配置文件和数据库凭据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Weaver Network Co., Ltd. | E-cology | 0 ~ 10.52 | - |
II. Public POCs for CVE-2022-50992
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-50992
请登录查看更多情报信息。
- 泛微产品线联合下载中心patch
- https://www.cnvd.org.cn/flaw/show/CNVD-2022-43245third-party-advisory
- 泛微 ECOLOGY 安全更新日志release-notes
- https://nvd.nist.gov/vuln/detail/CVE-2022-50992
IV. Related Vulnerabilities
Same product: E-cology
- CVE-2026-22679
Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug - CVE-2025-34038
Weaver E-cology SQL Injection - CVE-2024-7704
Weaver e-cology Source Code ecology_dev.zip information disc - CVE-2023-3793
Weaver e-cology HTTP POST Request filelFileDownloadForOutDoc - CVE-2023-2806
Weaver e-cology API RequestInfoByXml xml external entity ref
Same weakness: CWE-22
- CVE-2026-8274
npitre cramfs-tools Directory cramfsck.c do_directory path t - CVE-2022-50956
WordPress Plugin amministrazione-aperta 3.7.3 Local File Rea - CVE-2026-8215
Industrial Application Software IAS Canias ERP RMI iasReques - CVE-2026-42605
AzuraCast: Path Traversal in `currentDirectory` Parameter En - CVE-2026-42574
apko dirFS has a symlink-following path traversal that allow
V. Comments for CVE-2022-50992
No comments yet