GHSA-j6x3-3jqq-m922

ghsaUSosv

CrafterCMS OS Command Injection vulnerability

view advisory published 2022-09-14Licence: CC-BY-4.0

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-40635US	high7.2	1.62% (76th)	Exploit	2022-09-13
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypa…

references

External citations — patches, advisories, analysis.

https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602WEB
https://github.com/craftercms/craftercmsPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-40635ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan