Arbitrary Code Execution Vulnerability in Pebble Templates by Pebble
CVE-2022-37767

9.8CRITICAL

Key Information:

Vendor

Pebbletemplates

Status
Pebble Templates
Vendor
CVE Published:
12 September 2022

What is CVE-2022-37767?

Pebble Templates 3.1.5 is susceptible to a vulnerability that allows attackers to bypass certain security protections, leading to arbitrary code execution. While the vendor contends that the design permits arbitrary Java code as input, it highlights a critical need for applications utilizing the Pebble templating engine to enforce stringent input validation and restrictions. This exploitation path opens avenues for potential attacks if untrusted data is processed without due diligence.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/Y4tacker/Web-Security/issues/3
https://github.com/PebbleTemplates/pebble/issues/625#issu...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.