CVE-2022-37027

Katalog CVE

CVSS 7.2 · High EPSS 22,2%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada ahsay cloud backup suite. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.

Rincian

Terbit di NVD

21 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

22,2% peluang dieksploitasi; lebih tinggi dari 97,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wiki.ahsay.com/doku.php?id=public:resources:release_notes_v9320 release notes · advisory vendor
• https://www.ahsay.com/jsp/en/downloads/ahsay-downloads_latest-software_ahsaycbs.jsp product · advisory vendor
• https://www.ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_latest_hotfix permissions required · advisory vendor
• https://www.compass-security.com/en/research/advisories advisory pihak ketiga
• https://www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Par... exploit · advisory pihak ketiga