// For flags

CVE-2022-37767

 

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.

** EN DISPUTA ** Pebble Templates versión 3.1.5, permite a atacantes omitir un mecanismo de protección e implementar una ejecución de código arbitrario con springbok. NOTA: el proveedor discute esto porque la entrada al motor de plantillas de Pebble está pensada para incluir código Java arbitrario, y por lo tanto, o bien la entrada no debería llegar de una fuente no fiable, o bien la aplicación que utiliza el motor debería aplicar restricciones a la entrada. El motor no es responsable de validar la entrada

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-08-08 CVE Reserved
  • 2022-09-12 CVE Published
  • 2024-04-04 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Pebbletemplates
Search vendor "Pebbletemplates"
 Pebble Templates
Search vendor "Pebbletemplates" for product "Pebble Templates"
 3.1.5
Search vendor "Pebbletemplates" for product "Pebble Templates" and version "3.1.5"
-
Affected