Remote Code Execution Vulnerability in Document Merge Service Could Lead to Full System Takeover
CVE-2024-37301

7.2HIGH

Key Information:

Vendor

Adfinis

Status
Document-merge-service
Vendor
CVE Published:
11 June 2024

What is CVE-2024-37301?

The Document Merge Service, an API designed for managing document templates and their merging with data, is vulnerable to remote code execution due to server-side template injection. Attackers can exploit this vulnerability in versions 6.5.1 and earlier. If executed with root privileges, this flaw may enable an adversary to fully compromise the affected system. Currently, no patched version is available, and no official workarounds have been provided.

Affected Version(s)

document-merge-service < 6.5.2

References

https://github.com/adfinis/document-merge-service/securit...
x_refsource_CONFIRM
https://github.com/adfinis/document-merge-service/commit/...
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.