CVEvulnerability
CVE-2022-37027
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-09-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-88
Description
Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.
Affected configurations
• ahsay cloud backup suite 9.1.4.0
Related
Weakness · CWE (1)
- CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness
References
- https://wiki.ahsay.com/doku.php?id=public:resources:release_notes_v9320 Release Notes, Vendor Advisory
- https://www.ahsay.com/jsp/en/downloads/ahsay-downloads_latest-software_ahsaycbs.jsp Product, Vendor Advisory
- https://www.ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_latest_hotfix Permissions Required, Vendor Advisory
- https://www.compass-security.com/en/research/advisories Third Party Advisory
- https://www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txt Exploit, Third Party Advisory
- https://wiki.ahsay.com/doku.php?id=public:resources:release_notes_v9320 Release Notes, Vendor Advisory
- https://www.ahsay.com/jsp/en/downloads/ahsay-downloads_latest-software_ahsaycbs.jsp Product, Vendor Advisory
- https://www.ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_latest_hotfix Permissions Required, Vendor Advisory
- https://www.compass-security.com/en/research/advisories Third Party Advisory
- https://www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txt Exploit, Third Party Advisory