What is the CVSS score of CVE-2022-36344?

CVE-2022-36344 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Atok Medical 2 CVE-2022-36344

CRITICAL

Unquoted Search Path or Element (CWE-428)

2022-08-16 vultures@jpcert.or.jp

Microsoft Information Disclosure Atok Medical 2 Atok Medical 3 Atok Pro 3 Atok Pro 4 Atok Pro 5 Hanako Police 5 Hanako Police 6 Hanako Police 7 Hanako Pro 3 Hanako Pro 4 Hanako Pro 5 Homepage Builder 20 Homepage Builder 21 Homepage Builder 22 Ichitaro Government 10 Ichitaro Government 8 Ichitaro Government 9 Ichitaro Pro 3 Ichitaro Pro 4 Ichitaro Pro 5 Just Calc 3 Just Calc 4 Just Calc 5 Just Focus 3 Just Focus 4 Just Frontier 3 Just Government 2 Just Government 3 Just Government 4 Just Government 5 Just Jump 8 Just Jump Class Just Jump Class 2 Just Medical 2 Just Medical 3 Just Medical 4 Just Medical 5 Just Note 3 Just Note 4 Just Note 5 Just Office 2 Just Office 3 Just Office 4 Just Office 5 Just Pdf 3 Just Pdf 4 Just Pdf 5 Just Police 2 Just Police 3 Just Police 4 Just Police 5 Just School 6 Just School 7 Just Smile 6 Just Smile 7 Just Smile 8 Just Smile Class 2 Shuriken Pro 6 Shuriken Pro 7 Tri De Dataprotect

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Aug 16, 2022 - 08:15 nvd

CRITICAL 9.8

DescriptionNVD

An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.

AnalysisAI

An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-428. An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect. Affected products include: Justsystems Atok Medical 2, Justsystems Atok Medical 3, Justsystems Atok Pro 3, Justsystems Atok Pro 4, Justsystems Atok Pro 5.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.