CVE-2022-22916

CriticalCVSS 9.8

Published: 17/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

38.39%

98th percentile - higher than 98% of all known CVEs

Summary

O2OA version 6.4.7 contains a remote code execution (RCE) vulnerability via the /x_program_center/jaxrs/invoke endpoint. An attacker can send a specially crafted request to execute arbitrary code on the server.

Risk Assessment

The risk for the organization includes full server compromise, data theft, or service disruption.

Recommendation

It is recommended to immediately update O2OA to the latest version that fixes this vulnerability and restrict access to the /x_program_center/jaxrs/invoke endpoint to trusted networks only.

Original NVD description (English source)

O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.