Critical severityNVD Advisory· Published Sep 12, 2022· Updated Aug 3, 2024

CVE-2022-37767

Description

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.pebbletemplates:pebbleMaven	<= 3.1.5	—

Affected products

Pebble Templates/Pebble Templatesdescription
ghsa-coords
pkg:maven/io.pebbletemplates/pebble
Range: <= 3.1.5

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-wxx5-w9jc-48wxghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-37767ghsaADVISORY
github.com/PebbleTemplates/pebble/issues/625ghsaWEB
github.com/Y4tacker/Web-Security/issues/3ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000