CVE-2022-40634: Improper Control of Dynamically-Managed Code Resources in Crafter Studio
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.craftercms:crafter-studioto a version that resolves this vulnerability.Fixed in 3.1.23
Event History
Frequently Asked Questions
What is CVE-2022-40634 vulnerability?
CVE-2022-40634 is an Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS.
Who is affected by CVE-2022-40634?
Authenticated developers using Crafter Studio version 3.1.0 to 3.1.23 are affected by CVE-2022-40634.
How can authenticated developers exploit CVE-2022-40634?
Authenticated developers can execute OS commands via FreeMarker SSTI to exploit CVE-2022-40634.
What is the severity of CVE-2022-40634?
CVE-2022-40634 has a severity rating of 7.2 (high).
How can I fix CVE-2022-40634?
To fix CVE-2022-40634, upgrade Crafter Studio to version 3.1.24 or higher.