{"id":"CVE-2022-47879","aliases":["EUVD-2022-50636","GHSA-hvp3-qrpc-r6hh"],"status":"published","title":"A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote...","description":"A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods. NOTE: The vendor states that the vulnerability affects installations running version 22.5 or earlier. The issue was resolved with version 23.2 and later versions are not affected.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.06298,"percentile":0.93649,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2023-05-12T00:00:00Z","modified":"2026-07-09T01:18:02Z","exploits":[{"source":"exploitdb","id":"EDB-51423","title":"Jedox 2022.4.2 - Code Execution via RPC Interfaces","type":"webapps","platform":"php","date":"2023-05-05","url":"https://www.exploit-db.com/exploits/51423"}],"products":[{"vendor":"jedox","product":"jedox"},{"vendor":"jedox","product":"jedox_cloud"}],"references":[{"url":"https://docs.syslifters.com/assets/vulnerability-disclosure/Vulnerability-Disclosure-Jedox-Jedox-04-2023.pdf","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://jedox.mantishub.io/app/issues/57238"},{"url":"https://jedox.mantishub.io/app/issues/57236"},{"url":"https://jedox.mantishub.io/app/issues/57237"},{"url":"https://jedox.mantishub.io/app/issues/57239"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-47879"},{"url":"http://jedox.com"},{"url":"https://github.com/advisories/GHSA-hvp3-qrpc-r6hh"}],"sources":{"cve":[{"id":"CVE-2022-47879","description":"A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods. NOTE: The vendor states that the vulnerability affects installations running version 22.5 or earlier. The issue was resolved with version 23.2 and later versions are not affected.","status":"published","published":"2023-05-12T00:00:00Z","modified":"2026-07-09T00:23:20.209Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:25.308772Z"}],"euvd":[{"id":"EUVD-2022-50636","description":"A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods. NOTE: The vendor states that the vulnerability affects installations running version 22.5 or earlier. The issue was resolved with version 23.2 and later versions are not affected.","status":"published","published":"2023-05-12T00:00:00Z","modified":"2026-07-09T00:23:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:06.781463Z"}],"ghsa":[{"id":"GHSA-hvp3-qrpc-r6hh","title":"A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote...","description":"A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods.","status":"published","published":"2023-05-12T15:30:22Z","modified":"2025-11-05T21:30:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:04:40.688125Z"}],"nvd":[{"id":"CVE-2022-47879","description":"A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods. NOTE: The vendor states that the vulnerability affects installations running version 22.5 or earlier. The issue was resolved with version 23.2 and later versions are not affected.","status":"published","published":"2023-05-12T14:15:09.567Z","modified":"2026-07-09T01:18:02.87Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:37.42466Z"}]}}