CVE-2022-36344: Justsystems Atok Medical 2

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.

Affected products

• Justsystems Atok Medical 2: any version
• Justsystems Atok Medical 3: any version
• Justsystems Atok Pro 3: any version
• Justsystems Atok Pro 4: any version
• Justsystems Atok Pro 5: any version
• Justsystems Hanako Police 5: any version
• Justsystems Hanako Police 6: any version
• Justsystems Hanako Police 7: any version
• Justsystems Hanako Pro 3: any version
• Justsystems Hanako Pro 4: any version
• Justsystems Hanako Pro 5: any version
• Justsystems Homepage Builder 20: any version
• Justsystems Homepage Builder 21: any version
• Justsystems Homepage Builder 22: any version
• Justsystems Ichitaro Government 10: any version
• Justsystems Ichitaro Government 8: affected versions not specified
• Justsystems Ichitaro Government 9: any version
• Justsystems Ichitaro Pro 3: any version
• Justsystems Ichitaro Pro 4: any version
• Justsystems Ichitaro Pro 5: any version
• Justsystems Just Calc 3: any version
• Justsystems Just Calc 4: any version
• Justsystems Just Calc 5: any version
• Justsystems Just Focus 3: any version
• Justsystems Just Focus 4: any version
• and 35 more

Published 2022-08-16. Last modified 2026-06-17.