CVE-2022-31795

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo function in grel.php. An attacker is able to influence the username (user), password (pw), and file-name (file) parameters and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.

• CWE-78

• https://cwe.mitre.org/data/definitions/78.htmlThird Party Advisory
• https://research.nccgroup.com/2022/05/27/technical-advisory-fujitsu-centricstor-control-center-v8-1-unauthenticated-command-injection/Exploit, Third Party Advisory
• https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-PSS-IS-2022-050316-Security-Notice-SF.pdfVendor Advisory
• https://cwe.mitre.org/data/definitions/78.htmlThird Party Advisory
• https://research.nccgroup.com/2022/05/27/technical-advisory-fujitsu-centricstor-control-center-v8-1-unauthenticated-command-injection/Exploit, Third Party Advisory
• https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-PSS-IS-2022-050316-Security-Notice-SF.pdfVendor Advisory

Published

Jun 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3179Weak Password Requirements in GitHub repository ikus060/rdif…8.8
• CVE-2022-31790WatchGuard Firebox and XTM appliances allow an unauthenticat…7.5
• CVE-2022-31791WatchGuard Firebox and XTM appliances allow a local attacker…7.8
• CVE-2022-31792A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2022-31793do_request in request.c in muhttpd before 1.1.7 allows remot…7.5
• CVE-2022-31794An issue was discovered on Fujitsu ETERNUS CentricStor CS800…9.8
• CVE-2022-31796libjpeg 1.63 has a heap-based buffer over-read in Hierarchic…6.5
• CVE-2022-31798Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerab…6.1
• CVE-2022-31799Bottle before 0.12.20 mishandles errors during early request…9.8
• CVE-2022-3180The WPGateway Plugin for WordPress is vulnerable to privileg…9.8
• CVE-2022-31800An unauthenticated, remote attacker could upload malicious l…9.8
• CVE-2022-31801An unauthenticated, remote attacker could upload malicious l…9.8