PT-2022-7176

CVE-2022-40635

Published

2022-09-13

Updated

2026-05-06

Description by

CVSS 2.0

8.3

High

MetricsAV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Crafter Studio of Crafter CMS (affected versions not specified)

Description The issue is related to an Improper Control of Dynamically-Managed Code Resources vulnerability. This vulnerability allows authenticated developers to execute OS commands via a Groovy Sandbox Bypass. It may enable a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Mal

Matei Badanoiu

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-913: Improper Control of Dynamically-Managed Code Resources

Related identifiers

CVE-2022-40635