8.8

CVE-2022-39051

Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Otrs ≫ Otrs SwEditioncommunity Version >= 6.0.0 <= 6.0.32
Otrs ≫ Otrs Version >= 7.0.0 < 7.0.37
Otrs ≫ Otrs Version >= 8.0.0 < 8.0.25
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.633
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
security@otrs.com 6.8 0.9 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CWE-913 Improper Control of Dynamically-Managed Code Resources

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.