CVE-2022-40635
Published: 13 September 2022
Summary
CVE-2022-40635 is a medium-severity Improper Control of Dynamically-Managed Code Resources (CWE-913) vulnerability in Craftercms Crafter Cms. Its CVSS base score is 6.4 (Medium).
Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-40635 is an Improper Control of Dynamically-Managed Code Resources vulnerability, tracked under CWE-913, that affects Crafter Studio within Crafter CMS. It enables authenticated developers to bypass the Groovy sandbox and execute operating system commands. The flaw received a CVSS 3.1 score of 6.4 reflecting network attack vector, high attack complexity, high privileges required, and required user interaction, with high impact across confidentiality, integrity, and availability.
An authenticated developer can exploit the issue to run arbitrary OS commands on the affected system. The attack requires the attacker to already possess developer credentials and to overcome the sandbox restrictions through the identified bypass technique.
Public advisories published by CrafterCMS at https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051602 detail the vulnerability and recommended remediation steps for users of the affected versions.
The associated EPSS score reached a peak of 0.1299 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6848
Vulnerability details
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring explicit authorization and ongoing control of mobile code implements proper management of dynamically loaded code resources.