« Volver al listado

CVE-2022-40635

Estado: ModificadaAlta (7.2)—

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Craftercms — Crafter CMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-40635",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@craftersoftware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@craftersoftware.com",
      "affectedData": [
        {
          "vendor": "Crafter Software",
          "product": "Crafter CMS",
          "versions": [
            {
              "status": "affected",
              "version": "3.1",
              "versionType": "custom",
              "lessThanOrEqual": "3.1.22"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-13T19:15:13.440",
  "references": [
    {
      "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@craftersoftware.com"
    },
    {
      "url": "https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@craftersoftware.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-913"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-913"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Control Inapropiado de los Recursos de Código Administrados Dinámicamente en Crafter Studio de Crafter CMS permite a desarrolladores autenticados ejecutar comandos del Sistema Operativo por medio de Groovy Sandbox Bypass"
    }
  ],
  "lastModified": "2026-06-17T05:01:45.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:craftercms:crafter_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C6D4673-2898-4073-9239-71735D0FA5F2",
              "versionEndExcluding": "3.1.23",
              "versionStartIncluding": "3.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@craftersoftware.com"
}