CVE:CVE-2022-34558
CNNVD:CNNVD-202207-2653
WMAgent是dmwm开源的一个 CMS 的核心工作流管理组件。
WMAgent v1.3.3rc2版本和1.3.3rc1版本、reqmgr 2 1.4.1rc5版本和1.4.0rc2版本、reqmon 1.4.1rc5版本和global-workqueue 1.4.1rc5版本存在安全漏洞。攻击者利用该漏洞通过特制的dbs-client包执行任意代码。
solution:Upgrade global-workqueue_project global-workqueue to a higher version than 1.4.1:rc5,and avoid the version 1.4.1:rc5; Upgrade reqmgr2_project reqmgr2 to a higher version than 1.4.0:rc2,1.4.1:rc5,and avoid the version 1.4.0:rc2,1.4.1:rc5; Upgrade reqmon_project reqmon to a higher version than 1.4.1:rc5,and avoid the version 1.4.1:rc5; Upgrade wmagent_project wmagent to a higher version than 1.3.3:rc1,1.3.3:rc2,and avoid the version 1.3.3:rc1,1.3.3:rc2