What is CVE-2022-37767?

CVE-2022-37767 is a critical-severity vulnerability in Pebbletemplates Pebble Templates, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2022-09-12.

How severe is CVE-2022-37767?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Pebbletemplates Pebble Templates

CVE-2022-37767

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.

Vulnerability class: Broken Access Control

EPSS: 0.011 (63.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Pebbletemplates Pebble_templates — versions 3.1.5
N/a — versions n/a

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

cve@mitre.org (Exploit, Third Party Advisory, Issue Tracking)
cve@mitre.org (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2022-37767?: CVE-2022-37767 is a critical-severity vulnerability in Pebbletemplates Pebble Templates, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2022-09-12.
How severe is CVE-2022-37767?: Critical severity. CVSS v3 base score is 9.8 out of 10.