PT-2022-20435 · Gentics · Gentics Cms

Gerhard Hechenberger + 1 · Published 2022-07-17 · Updated 2022-07-21 · CVE-2022-30981

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gentics CMS versions prior to 5.43.1

Description An issue was discovered that allows an attacker to deserialize arbitrary data by uploading a malicious ZIP file, potentially achieving Java code execution.

Recommendations For versions prior to 5.43.1, update to version 5.43.1 or later to resolve the issue.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-30981

Affected Products

Gentics Cms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-30981 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30981 · Vendor Advisory
• https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilies-in-gentics-cms · Note