CVE-2022-47879

A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods. NOTE: The vendor states that the vulnerability affects installations running version 22.5 or earlier. The issue was resolved with version 23.2 and later versions are not affected.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://jedox.com	Product
https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf	Exploit Third Party Advisory
https://jedox.mantishub.io/app/issues/57236
https://jedox.mantishub.io/app/issues/57237
https://jedox.mantishub.io/app/issues/57238
https://jedox.mantishub.io/app/issues/57239
http://jedox.com	Product
https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:jedox:jedox:2020.2.5:::::::*
	cpe:2.3:a:jedox:jedox_cloud:-:::::::*

History

No history.

Information

Published : 2023-05-12 14:15

Updated : 2025-11-06 15:15

NVD link : CVE-2022-47879

Mitre link : CVE-2022-47879

CVE.ORG link : CVE-2022-47879

JSON object : View

Products Affected

jedox

jedox_cloud
jedox

CWE

NVD-CWE-noinfo CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2022-47879", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2023-05-12T14:15:09.567", "references": [{"url": "http://jedox.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://jedox.mantishub.io/app/issues/57236", "source": "cve@mitre.org"}, {"url": "https://jedox.mantishub.io/app/issues/57237", "source": "cve@mitre.org"}, {"url": "https://jedox.mantishub.io/app/issues/57238", "source": "cve@mitre.org"}, {"url": "https://jedox.mantishub.io/app/issues/57239", "source": "cve@mitre.org"}, {"url": "http://jedox.com", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods. NOTE: The vendor states that the vulnerability affects installations running version 22.5 or earlier. The issue was resolved with version 23.2 and later versions are not affected."}], "lastModified": "2025-11-06T15:15:45.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jedox:jedox:2020.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CD31D96-EC95-4111-A9A8-504144689CFF"}, {"criteria": "cpe:2.3:a:jedox:jedox_cloud:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E29BFD3-4EC1-4323-B834-5AA35EE2AEE1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}