Auth bypass in Pebbletemplates Pebble Templates
CVE-2022-37767
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (72.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 72.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.015 · change: +0.003
Affected products
- Pebbletemplates Pebble Templates — versions 3.1.5
Weakness classification (CWE)
References
- github.com/Y4tacker/Web-Security/issues/3 (Exploit, Third Party Advisory, Issue Tracking)
- github.com/PebbleTemplates/pebble/issues/625 (Exploit, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2022-37767?
- CVE-2022-37767 is a critical-severity vulnerability in Pebbletemplates Pebble Templates, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2022-09-12.
- How severe is CVE-2022-37767?
- Critical severity. CVSS v3 base score is 9.8 out of 10.