CVE-2022-40635 - Vulnerability Details - OpenCVE

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.1299.

Key SSVC decision points have not yet been added.

Vendors	Products
Craftercms Subscribe	Crafter Cms Subscribe

Configuration 1 [-]

cpe:2.3:a:craftercms:crafter_cms:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
Github GHSA	GHSA-j6x3-3jqq-m922	CrafterCMS OS Command Injection vulnerability

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: crafter

Published: 2022-09-13T18:25:10.622257Z

Updated: 2024-09-16T16:13:57.113Z

Reserved: 2022-09-13T00:00:00

Link: CVE-2022-40635

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-09-13T19:15:13.440

Modified: 2024-11-21T07:21:45.373

Link: CVE-2022-40635

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-913

{"containers": {"cna": {"affected": [{"product": "Crafter CMS", "vendor": "Crafter Software", "versions": [{"lessThanOrEqual": "3.1.22", "status": "affected", "version": "3.1", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Matei \"Mal\" Badanoiu"}], "datePublic": "2022-09-13T00:00:00", "descriptions": [{"lang": "en", "value": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-913", "description": "CWE-913 Improper Control of Dynamically-Managed Code Resources", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-13T18:25:10", "orgId": "4ff2b028-869f-4b00-a7b2-05997f6f14fd", "shortName": "crafter"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602"}], "source": {"discovery": "EXTERNAL"}, "title": "Improper Control of Dynamically-Managed Code Resources in Crafter Studio", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@craftersoftware.com", "DATE_PUBLIC": "2022-09-13T15:42:00.000Z", "ID": "CVE-2022-40635", "STATE": "PUBLIC", "TITLE": "Improper Control of Dynamically-Managed Code Resources in Crafter Studio"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Crafter CMS", "version": {"version_data": [{"version_affected": "<=", "version_name": "3.1", "version_value": "3.1.22"}]}}]}, "vendor_name": "Crafter Software"}]}}, "credit": [{"lang": "eng", "value": "Matei \"Mal\" Badanoiu"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-913 Improper Control of Dynamically-Managed Code Resources"}]}]}, "references": {"reference_data": [{"name": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602", "refsource": "MISC", "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:21:46.555Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602"}]}]}, "cveMetadata": {"assignerOrgId": "4ff2b028-869f-4b00-a7b2-05997f6f14fd", "assignerShortName": "crafter", "cveId": "CVE-2022-40635", "datePublished": "2022-09-13T18:25:10.622257Z", "dateReserved": "2022-09-13T00:00:00", "dateUpdated": "2024-09-16T16:13:57.113Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:craftercms:crafter_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C6D4673-2898-4073-9239-71735D0FA5F2", "versionEndExcluding": "3.1.23", "versionStartIncluding": "3.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass."}, {"lang": "es", "value": "Una vulnerabilidad de Control Inapropiado de los Recursos de C\u00f3digo Administrados Din\u00e1micamente en Crafter Studio de Crafter CMS permite a desarrolladores autenticados ejecutar comandos del Sistema Operativo por medio de Groovy Sandbox Bypass"}], "id": "CVE-2022-40635", "lastModified": "2024-11-21T07:21:45.373", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.9, "source": "security@craftersoftware.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-13T19:15:13.440", "references": [{"source": "security@craftersoftware.com", "tags": ["Vendor Advisory"], "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602"}], "sourceIdentifier": "security@craftersoftware.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-913"}], "source": "security@craftersoftware.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-913"}], "source": "nvd@nist.gov", "type": "Primary"}]}