CVE-2022-40634
Published: 13 September 2022
Summary
CVE-2022-40634 is a medium-severity Improper Control of Dynamically-Managed Code Resources (CWE-913) vulnerability in Craftercms Crafter Cms. Its CVSS base score is 6.4 (Medium).
Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-40634 is an Improper Control of Dynamically-Managed Code Resources vulnerability, tracked under CWE-913, that affects Crafter Studio within Crafter CMS. It enables authenticated developers to execute operating system commands through a FreeMarker server-side template injection flaw. The issue carries a CVSS 3.1 score of 6.4 with a network attack vector, high attack complexity, high privileges required, and user interaction needed.
An authenticated developer can leverage the flaw to run arbitrary OS commands on the affected system, resulting in high impact to confidentiality, integrity, and availability.
Public advisories addressing the issue are published by CrafterCMS at https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051601.
The associated EPSS score has remained flat at a peak and current value of 0.1452 with no material rise observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6664
Vulnerability details
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring explicit authorization and ongoing control of mobile code implements proper management of dynamically loaded code resources.