CVE-2022-37027
- State
- Published
- Severity
- 7.2 High
- Published
- Sep 21, 2022
- Updated
- May 28, 2025
- Reserved
- Jul 29, 2022
Description
Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://www.ahsay.com/jsp/en/downloads/ahsay-downloads_latest-software_ahsaycbs.jsp
- https://www.compass-security.com/en/research/advisories
- https://wiki.ahsay.com/doku.php?id=public:resources:release_notes_v9320
- https://www.ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_latest_hotfix
- https://www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txt
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.