GitHub Advisoryadvisory · Maven

GHSA-wxx5-w9jc-48wx Pebble Templates protection mechanism bypass can lead to arbitrary code execution

CRITICAL Published 2022-09-13 Modified 2022-09-16 Official page ↗

Aliases: CVE-2022-37767
Ecosystem: Maven
Packages: io.pebbletemplates:pebble
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-863
Reviewed: 2022-09-15

Affected packages

• Maven io.pebbletemplates:pebble: <= 3.1.5 (no fix yet)

Description

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok.

Related

Alias · CVE (1)

CVE-2022-37767 Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. vulnerability

Weakness · CWE (1)

CWE-863 Incorrect Authorization weakness

References