GHSA-2jv3-v37p-65w3

CrafterCMS Crafter Studio Improperly Controls Dynamically-Managed Code Resources

Source: GitHub Advisory Database (reviewed) High CVE-2022-40634

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.craftercms:crafter-studio	>= 3.1.0, < 3.1.23	3.1.23

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-40634 advisory
https://docs.craftercms.org/en/3.1/security/advisory.html#cv-2022051601 web
https://github.com/craftercms/studio package