Lucene search

MitreCVE-2022-37027

HistorySep 21, 2022 - 5:15 p.m.

CVE-2022-37027

2022-09-2117:15:09

CWE-88

mitre

web.nvd.nist.gov

ahsay

ahsaycbs

cve-2022-37027

authenticated user

java

jvm options

remote code execution

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.005

Percentile

77.5%

JSON

Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.

Affected configurations

Nvd

Node

ahsaycloud_backup_suiteMatch9.1.4.0

VendorProductVersionCPE
ahsaycloud_backup_suite9.1.4.0cpe:2.3:a:ahsay:cloud_backup_suite:9.1.4.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ahsay	cloud_backup_suite	9.1.4.0	cpe:2.3:a:ahsay:cloud_backup_suite:9.1.4.0:::::::*

References

wiki.ahsay.com/doku.php?id=public:resources:release_notes_v9320

www.ahsay.com/jsp/en/downloads/ahsay-downloads_latest-software_ahsaycbs.jsp

www.ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_latest_hotfix

www.compass-security.com/en/research/advisories

www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txt

Social References

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.005

Percentile

77.5%

JSON

Related for CVE-2022-37027