Zenario CMS is vulnerable to Remote Code Execution (RCE).
The advisory, in context
Zenario CMS 9.3.57186 is vulnerable to RCE.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 9.0.57473
Fixed in 9.0.57473
62 explicitly affected versions
7.5.40440, 7.5.41006, 7.5.41499, 7.5.41633, 7.5.42085, 7.5.42990, 7.5.47180, 7.6.41504, 7.6.41633, 7.6.42085, 7.6.42990, 7.6.47180, 7.7.42682, 7.7.42963, 7.7.42990, 7.7.44223, 7.7.47180, 7.7.47369, 7.7.48583, 8.0.44237, 8.0.44273, 8.0.44294, 8.0.44521, 8.0.45032, 8.0.45250, 8.0.45529, 8.0.47180, 8.0.48583, 8.1.45530, 8.1.45698, 8.1.46089, 8.1.46433, 8.1.46615, 8.1.47180, 8.1.47369, 8.1.48583, 8.2.46436, 8.2.46614, 8.2.47180, 8.2.47369, 8.2.47992, 8.2.48583, 8.3.47997, 8.3.48583, 8.3.50564, 8.4.50565, 8.4.51340, 8.5.50567, 8.5.50837, 8.5.51340, 8.6.51342, 8.7, 8.8, 8.8.53370, 8.8.53725, 8.8.54063, 8.9.54063, 8.9.54149, 8.9.54153, 8.9.55141, 9.0.54156, 9.0.55141
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.57473"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.5.40440",
"7.5.41006",
"7.5.41499",
"7.5.41633",
"7.5.42085",
"7.5.42990",
"7.5.47180",
"7.6.41504",
"7.6.41633",
"7.6.42085",
"7.6.42990",
"7.6.47180",
"7.7.42682",
"7.7.42963",
"7.7.42990",
"7.7.44223",
"7.7.47180",
"7.7.47369",
"7.7.48583",
"8.0.44237",
"8.0.44273",
"8.0.44294",
"8.0.44521",
"8.0.45032",
"8.0.45250",
"8.0.45529",
"8.0.47180",
"8.0.48583",
"8.1.45530",
"8.1.45698",
"8.1.46089",
"8.1.46433",
"8.1.46615",
"8.1.47180",
"8.1.47369",
"8.1.48583",
"8.2.46436",
"8.2.46614",
"8.2.47180",
"8.2.47369",
"8.2.47992",
"8.2.48583",
"8.3.47997",
"8.3.48583",
"8.3.50564",
"8.4.50565",
"8.4.51340",
"8.5.50567",
"8.5.50837",
"8.5.51340",
"8.6.51342",
"8.7",
"8.8",
"8.8.53370",
"8.8.53725",
"8.8.54063",
"8.9.54063",
"8.9.54149",
"8.9.54153",
"8.9.55141",
"9.0.54156",
"9.0.55141"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2022-44136
- https://github.com/TribalSystems/Zenario/commit/4f95a557af3c0b82e448a6ff8f4c167525972e4a
- https://com0t.github.io/zenar.io/2022/10/18/Unauthent-RCE-Zenar.io~9.3.html
- https://github.com/TribalSystems/Zenario
- https://github.com/TribalSystems/Zenario/compare/9.0.55141...9.0.57473
- https://github.com/TribalSystems/Zenario/releases/tag/9.0.57473