CVE-2022-24881CWE-94

Command Injection in Ballcat Codegen

High · published April 26, 2022

CVSS v3.1
8.8
EPSS
3%
Percentile
88.1
In the wild
Unconfirmed
What it is

Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03197 · 88.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2022-04-26T16:06Z
EPSS history
Timeline
  • 26 APR 16:06Z
    Command Injection in Ballcat Codegen
    cvelistv5