CVEvulnerability
CVE-2022-36344
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-08-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-428
Description
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
Affected configurations
• justsystems atok medical 2
• justsystems atok medical 3
• justsystems atok pro 3
• justsystems atok pro 4
• justsystems atok pro 5
• justsystems hanako police 5
• justsystems hanako police 6
• justsystems hanako police 7
• justsystems hanako pro 3
• justsystems hanako pro 4
• justsystems hanako pro 5
• justsystems homepage builder 20
• justsystems homepage builder 21
• justsystems homepage builder 22
• justsystems ichitaro government 10
• justsystems ichitaro government 8
• justsystems ichitaro government 9
• justsystems ichitaro pro 3
• justsystems ichitaro pro 4
• justsystems ichitaro pro 5
• justsystems just calc 3
• justsystems just calc 4
• justsystems just calc 5
• justsystems just focus 3
• justsystems just focus 4
• justsystems just frontier 3
• justsystems just government 2
• justsystems just government 3
• justsystems just government 4
• justsystems just government 5
• justsystems just jump 8
• justsystems just jump class
• justsystems just jump class 2
• justsystems just medical 2
• justsystems just medical 3
• justsystems just medical 4
• justsystems just medical 5
• justsystems just note 3
• justsystems just note 4
• justsystems just note 5
• justsystems just office 2
• justsystems just office 3
• justsystems just office 4
• justsystems just office 5
• justsystems just pdf 3
• justsystems just pdf 4
• justsystems just pdf 5
• justsystems just police 2
• justsystems just police 3
• justsystems just police 4
• justsystems just police 5
• justsystems just school 6
• justsystems just school 7
• justsystems just smile 6
• justsystems just smile 7
• justsystems just smile 8
• justsystems just smile class 2
• justsystems shuriken pro 6
• justsystems shuriken pro 7
• justsystems tri-de dataprotect
Related
Weakness · CWE (1)
- CWE-428 Unquoted Search Path or Element weakness
References
- https://jvn.jp/en/jp/JVN57073973/index.html Third Party Advisory
- https://www.justsystems.com/jp/corporate/info/js22001.html Vendor Advisory
- https://jvn.jp/en/jp/JVN57073973/index.html Third Party Advisory
- https://www.justsystems.com/jp/corporate/info/js22001.html Vendor Advisory