CVE-2022-25237: Bonitasoft Bonita Web

Critical severity, CVSS 9.8. EPSS: 56.4% chance of exploitation in the next 30 days.

Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. By appending ;i18ntranslation or /../i18ntranslation/ to the end of a URL, users with no privileges can access privileged API endpoints. This can lead to remote code execution by abusing the privileged API actions.

Affected products

• Bonitasoft Bonita Web: version 2021.2 only

Published 2022-06-02. Last modified 2026-06-17.