« Volver al listado

CVE-2022-39051

Estado: ModificadaAlta (8.8)—

Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Otrs — Otrs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-39051",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@otrs.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@otrs.com",
      "affectedData": [
        {
          "vendor": "OTRS AG",
          "product": "OTRS",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.x 7.0.36"
            },
            {
              "status": "affected",
              "version": "8.0.x 8.0.24"
            }
          ]
        },
        {
          "vendor": "OTRS AG",
          "product": "((OTRS)) Community Edition",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.1",
              "lessThan": "6.0.x*",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-05T07:15:08.117",
  "references": [
    {
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2022-12/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@otrs.com"
    },
    {
      "url": "https://otrs.com/release-notes/otrs-security-advisory-2022-12/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@otrs.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-913"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-913"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package"
    },
    {
      "lang": "es",
      "value": "El atacante podría ser capaz de ejecutar código Perl malicioso en el kit de herramientas Template, haciendo que el administrador instale un paquete de 3ª parte no verificado"
    }
  ],
  "lastModified": "2026-06-17T04:57:30.323",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2330DDC0-20DF-4031-A4A3-017F0E73C08A",
              "versionEndIncluding": "6.0.32",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDB57B12-C33A-499A-AD20-7608053FB2B1",
              "versionEndExcluding": "7.0.37",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:otrs:otrs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F9BA949-D450-43E5-907C-CC981270C588",
              "versionEndExcluding": "8.0.25",
              "versionStartIncluding": "8.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@otrs.com"
}