CVE-2022-36344
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License'...
CVE-2022-36344 is a critical vulnerability (CVSS 9.8) in Justsystems Corporation Just Online Update For J-license', published August 16, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 60th percentile. No source names a fixed version.
- Severity
- 9.8 CriticalCVSS 3.1, NVD
- Exploit chance
- 0.90%EPSS, 60th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
- justsystems corporation just online update for j-license'
- justsystems atok medical 2
- justsystems atok medical 3
- justsystems atok pro 3
- justsystems atok pro 4
- justsystems atok pro 5
- justsystems hanako police 5
- justsystems hanako police 6
- justsystems hanako police 7
- justsystems hanako pro 3
- justsystems hanako pro 4
- justsystems hanako pro 5
Show 49 moreShow less
- justsystems homepage builder 20
- justsystems homepage builder 21
- justsystems homepage builder 22
- justsystems ichitaro government 10
- justsystems ichitaro government 8
- justsystems ichitaro government 9
- justsystems ichitaro pro 3
- justsystems ichitaro pro 4
- justsystems ichitaro pro 5
- justsystems just calc 3
- justsystems just calc 4
- justsystems just calc 5
- justsystems just focus 3
- justsystems just focus 4
- justsystems just frontier 3
- justsystems just government 2
- justsystems just government 3
- justsystems just government 4
- justsystems just government 5
- justsystems just jump 8
- justsystems just jump class
- justsystems just jump class 2
- justsystems just medical 2
- justsystems just medical 3
- justsystems just medical 4
- justsystems just medical 5
- justsystems just note 3
- justsystems just note 4
- justsystems just note 5
- justsystems just office 2
- justsystems just office 3
- justsystems just office 4
- justsystems just office 5
- justsystems just pdf 3
- justsystems just pdf 4
- justsystems just pdf 5
- justsystems just police 2
- justsystems just police 3
- justsystems just police 4
- justsystems just police 5
- justsystems just school 6
- justsystems just school 7
- justsystems just smile 6
- justsystems just smile 7
- justsystems just smile 8
- justsystems just smile class 2
- justsystems shuriken pro 6
- justsystems shuriken pro 7
- justsystems tri-de dataprotect
What each source reports
NVD Score used
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
- Record
CVE-2022-36344- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-428
- Updated
- 2026-11-02
CVE ListNo score
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
- Record
CVE-2022-36344- Updated
- 2026-11-02
EUVDEUVD-2022-39060No score
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
- Record
EUVD-2022-39060- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xqgw-r8h6-587w
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License'...
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
- Record
GHSA-xqgw-r8h6-587w- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-428
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.