Vulnerability · Published Sep 21, 2022 · Assigned by mitre
CVE-2022-37027
High 7.2
In plain English
A high-severity argument injection in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 22.2% (higher than 98% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)22.2%top 2.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.
Affected products (as reported)
Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.ahsay.com/jsp/en/downloads/ahsay-downloads_latest-software_ahsaycbs.jsp x_refsource_MISC
- https://www.compass-security.com/en/research/advisories x_refsource_MISC
- https://wiki.ahsay.com/doku.php?id=public:resources:release_notes_v9320 x_refsource_MISC
- https://www.ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_latest_hotfix x_refsource_CONFIRM
- https://www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txt x_refsource_MISC