PT-2022-21927 · Alfasado · Powercms

Published 2022-09-08 · Updated 2023-08-08 · CVE-2022-33941

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PowerCMS versions 6.021 and earlier PowerCMS versions 5.21 and earlier PowerCMS versions 4.51 and earlier PowerCMS 3 Series and earlier

Description The PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection issue. By sending a specially crafted message via the POST method to the PowerCMS XMLRPC API, an attacker may be able to execute arbitrary Perl scripts, and subsequently, arbitrary OS commands.

Recommendations For PowerCMS versions 6.021 and earlier, consider disabling the XMLRPC API until a patch is available. For PowerCMS versions 5.21 and earlier, restrict access to the XMLRPC API to minimize the risk of exploitation. For PowerCMS versions 4.51 and earlier, avoid using the XMLRPC API for critical operations until the issue is resolved. For PowerCMS 3 Series and earlier, due to their End-of-Life status, it is recommended to upgrade to a supported version as soon as possible. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-33941

Affected Products

Powercms

References · 7

• https://osv.dev/vulnerability/CVE-2022-33941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33941 · Security Note
• https://powercms.jp/news/xmlrpc-api-provision-202208.html · Vendor Advisory
• https://jvn.jp/en/jp/JVN76024879/index.html · Note
• https://t.me/cvenotify/35852 · Telegram Post
• https://t.me/cvenotify/36278 · Telegram Post
• https://t.me/cibsecurity/49447 · Telegram Post