PT-2022-25431 · Crafter Cms · Crafter Studio

Mal + 1 · Published 2022-09-13 · Updated 2022-09-16 · CVE-2022-40634

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crafter Studio of Crafter CMS (affected versions not specified)

Description The issue allows authenticated developers to execute OS commands via FreeMarker SSTI due to improper control of dynamically-managed code resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-913

CWE-78

Related Identifiers

CVE-2022-40634

GHSA-2JV3-V37P-65W3

Affected Products

Crafter Studio

References · 6

• https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40634 · Security Note
• https://osv.dev/vulnerability/GHSA-2jv3-v37p-65w3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-40634 · Vendor Advisory
• https://github.com/craftercms/studio · Note
• https://t.me/cibsecurity/49703 · Telegram Post