{"cve":"CVE-2022-36344","nvd":{"published":"2022-08-16T08:15:09.157","modified":"2026-06-17T04:53:17.500","status":"Modified","description":"An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-428"],"references":["https://jvn.jp/en/jp/JVN57073973/index.html","https://www.justsystems.com/jp/corporate/info/js22001.html","https://jvn.jp/en/jp/JVN57073973/index.html","https://www.justsystems.com/jp/corporate/info/js22001.html"],"products":["justsystems:atok_medical_2","justsystems:atok_medical_3","justsystems:atok_pro_3","justsystems:atok_pro_4","justsystems:atok_pro_5","justsystems:hanako_police_5","justsystems:hanako_police_6","justsystems:hanako_police_7","justsystems:hanako_pro_3","justsystems:hanako_pro_4","justsystems:hanako_pro_5","justsystems:homepage_builder_20","justsystems:homepage_builder_21","justsystems:homepage_builder_22","justsystems:ichitaro_government_10","justsystems:ichitaro_government_8","justsystems:ichitaro_government_9","justsystems:ichitaro_pro_3","justsystems:ichitaro_pro_4","justsystems:ichitaro_pro_5","justsystems:just_calc_3","justsystems:just_calc_4","justsystems:just_calc_5","justsystems:just_focus_3","justsystems:just_focus_4","justsystems:just_frontier_3","justsystems:just_government_2","justsystems:just_government_3","justsystems:just_government_4","justsystems:just_government_5","justsystems:just_jump_8","justsystems:just_jump_class","justsystems:just_jump_class_2","justsystems:just_medical_2","justsystems:just_medical_3","justsystems:just_medical_4","justsystems:just_medical_5","justsystems:just_note_3","justsystems:just_note_4","justsystems:just_note_5","justsystems:just_office_2","justsystems:just_office_3","justsystems:just_office_4","justsystems:just_office_5","justsystems:just_pdf_3","justsystems:just_pdf_4","justsystems:just_pdf_5","justsystems:just_police_2","justsystems:just_police_3","justsystems:just_police_4"],"source":"nvd","synced_at":"2026-10-19T21:34:18.502168378+00:00"},"epss":{"cve":"CVE-2022-36344","score":0.00874,"percentile":0.58943,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}