CVE-2022-25237 - CVE House
Back to Database
Status published Critical CVE-2022-25237

Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability...

Vulnerability Description

Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API endpoints. This can lead to remote code execution by abusing the privileged API actions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-25237

Credits & Attribution

No credits recorded in the NVD database.

References

More from bonitasoft

View All →
CVE-2020-36640
bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity reference
Medium 5.5
CVE-2015-3898
Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3...
Medium 6.1
CVE-2015-3897
Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows...
Medium 5

Affected Vendor

Affected Software

bonita web
Vulnerable Versions:
2021.2

Timeline

Official Publish: May 27th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.