CVE-2022-50992
Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet
- State
- Published
- Severity
- 8.7 High
- Published
- Apr 30, 2026
- Updated
- Jul 15, 2026
- Reserved
- Apr 29, 2026
Description
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods. Attackers can exploit these methods without authentication to retrieve sensitive files including system configuration files and database credentials from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-12-14 (UTC).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
E-cologyWeaver Network Co., Ltd. |
|
References
- https://www.weaver.com.cn/cs/securityDownload.html#patch
- https://www.weaver.com.cn/cs/ecology_full_log.htmlrelease-notes
- https://www.cnvd.org.cn/flaw/show/CNVD-2022-43245third-party-advisory
- https://blog.csdn.net/qq_36618918/article/details/135104295technical-descriptionexploit
- https://blog.csdn.net/xiayu729100940/article/details/135205082technical-descriptionexploit
- https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-arbitrary-file-read-via-xmlrpcservletthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.