← Retour aux CVEs

CVE-2022-37767

CRITICAL

9.8

Description

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie9/12/2022

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

pebbletemplates:pebble_templates

Faiblesses (CWE)

CWE-863

References

https://github.com/PebbleTemplates/pebble/issues/625#issuecomment-1282138635(cve@mitre.org)

https://github.com/Y4tacker/Web-Security/issues/3(cve@mitre.org)

https://github.com/PebbleTemplates/pebble/issues/625#issuecomment-1282138635(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/Y4tacker/Web-Security/issues/3(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.