CVE-2022-47876
Published: 02 May 2023
Summary
CVE-2022-47876 is a high-severity an unspecified weakness vulnerability in Jedox Jedox. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-47876 affects the integrator component in Jedox GmbH Jedox 2020.2.5 and allows remote authenticated users to create jobs that execute arbitrary code via Groovy scripts. The vulnerability is rated 8.8 under CVSS 3.1 with an attack vector of network, low attack complexity, low privileges required, and no user interaction needed.
Remote authenticated attackers can exploit the issue to achieve arbitrary code execution, resulting in high impact to confidentiality, integrity, and availability. Public references include a vulnerability disclosure report and a proof-of-concept for Groovy scripts remote code execution.
The associated EPSS score rose from lower values to a peak of 0.1988 before receding to the current 0.0806.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-50633
Vulnerability details
The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.