Posted by disclosure via Fulldisclosure on Aug 170day Rubbish Research Team is publicly disclosing a vulnerability in RapidDeploy 5.2.2 (MidVision). The research is published and a proof-of-concept is available. Pre-authentication RCE (arbitrary file write) (CVSS 9.8, pre-authentication) MidVision RapidDeploy 5.2.2 ships a remote-agent template (midvision-remoting-server.xml) with host=0.0.0.0 and auth.servers commented out, making the JBoss Remoting layer network-reachable with no...