CVE-2022-26111

Katalog CVE

CVSS 8.8 · High EPSS 4,2%

Kerentanan Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') pada canon irisnext. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an existing/predefined search) of the documents. The search components permit adding BeanShell expressions that result in Remote Code Execution in the context of the IRISNext application user, running on the web server.

Rincian

Terbit di NVD

25 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

EPSS (30 hari)

4,2% peluang dieksploitasi; lebih tinggi dari 90,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://varsnext.iriscorporate.com/ product · advisory vendor
• https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-26111.pdf exploit · advisory pihak ketiga