CVE-2023-2766: Weaver OA e-office config file exposure via jx2_config.ini

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network reachability, no authentication, public exploit, and very high EPSS (98.9th percentile) make this a high-priority exposure despite no KEV listing.

What it is

Weaver OA 9.5 exposes the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini, allowing unauthenticated remote retrieval of files or directories. The vendor was contacted but did not respond, and a public exploit has been disclosed, so exposed instances are at immediate risk of configuration and credential leakage.

Impact

An unauthenticated attacker can read the exposed configuration file and potentially other files or directories, disclosing sensitive configuration data such as credentials or internal paths. This information can be used to further compromise the application or connected systems.

Attack surface

The flaw is reachable remotely over the network via a crafted request to the affected path, with no authentication or user interaction required per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

A public exploit is referenced (Exploit tag on the GitHub advisory), EPSS is 0.54232 (98.9th percentile), and the CVE is not listed in CISA KEV.

What to do

• Apply the vendor patch or upgrade to a fixed Weaver OA/e-office version; if no patch is available, restrict access to the affected path.
• Block external access to /building/backmgr/urlpage/mobileurl/configfile/ and similar configuration directories at the web server or WAF.
• Remove or relocate jx2_config.ini and any other configuration files from web-accessible directories.
• Rotate any credentials or secrets that may have been stored in the exposed configuration file.
• Monitor vendor advisories and VDB-229271 for updated remediation guidance since the vendor did not respond.

Detection

• Search web access logs for requests to /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini or similar config file paths.
• Alert on HTTP 200 responses to .ini, .config, or .conf files from external IPs.
• Monitor for scanning activity targeting Weaver OA paths and correlate with known exploit signatures.
• Review outbound traffic for exfiltration of configuration file contents following suspicious requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.