Vulnerability-Lookup

CVE-2022-33941 (GCVE-0-2022-33941)

Vulnerability from cvelistv5 – Published: 2022-09-08 07:10 – Updated: 2024-08-03 08:16

Summary

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

OS Command Injection

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 186 records in the last 180 days details

References

2 references

URL	Tags
https://www.powercms.jp/news/xmlrpc-api-provision…	x_refsource_MISC
https://jvn.jp/en/jp/JVN76024879/index.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
Alfasado Inc.	PowerCMS XMLRPC API	Affected: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), PowerCMS 4.51 and earlier (PowerCMS 4 Series), and PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:16:15.908Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN76024879/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PowerCMS XMLRPC API",
          "vendor": "Alfasado Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), PowerCMS 4.51 and earlier (PowerCMS 4 Series), and PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OS Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-08T07:10:41.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN76024879/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2022-33941",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PowerCMS XMLRPC API",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), PowerCMS 4.51 and earlier (PowerCMS 4 Series), and PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Alfasado Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html",
              "refsource": "MISC",
              "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN76024879/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN76024879/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-33941",
    "datePublished": "2022-09-08T07:10:41.000Z",
    "dateReserved": "2022-08-30T00:00:00.000Z",
    "dateUpdated": "2024-08-03T08:16:15.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-33941",
      "date": "2026-11-14",
      "epss": "0.01882",
      "percentile": "0.79813"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "PowerCMS XMLRPC API",
                "vendor": "Alfasado Inc.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), PowerCMS 4.51 and earlier (PowerCMS 4 Series), and PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL)"
                  }
                ]
              }
            ],
            "source": "vultures@jpcert.or.jp"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8260209D-6723-4FA5-8F94-55D35EA6F19A",
                    "versionEndIncluding": "4.51",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CFE5A5A9-FDBC-49E9-8B1C-7B3ED1F56287",
                    "versionEndIncluding": "5.21",
                    "versionStartIncluding": "5.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BF7FF9CD-2DF1-43E6-A801-D50B806C8158",
                    "versionEndIncluding": "6.021",
                    "versionStartIncluding": "6.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
          },
          {
            "lang": "es",
            "value": "La API PowerCMS XMLRPC proporcionada por Alfasado Inc. presenta una vulnerabilidad de inyecci\u00f3n de comandos.\u0026#xa0;El env\u00edo de un mensaje especialmente dise\u00f1ado mediante el m\u00e9todo POST a la API XMLRPC de PowerCMS puede permitir la ejecuci\u00f3n arbitraria de secuencias de comandos Perl y un comando arbitrario del Sistema Operativo puede ser ejecutado por medio de \u00e9l.\u0026#xa0;Los productos/versiones afectados son los siguientes: PowerCMS versiones 6.021 y anteriores (PowerCMS 6 Series), PowerCMS 5.21 y anteriores (PowerCMS 5 Series) y PowerCMS versiones 4.51 y anteriores (PowerCMS 4 Series).\u0026#xa0;Tenga en cuenta que todas las versiones de PowerCMS versiones 3 Series y anteriores que no son compatibles (fin de vida \u00fatil, EOL) tambi\u00e9n est\u00e1n afectadas por esta vulnerabilidad"
          }
        ],
        "id": "CVE-2022-33941",
        "lastModified": "2026-06-17T04:49:31.543",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2022-09-08T08:15:07.957",
        "references": [
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/jp/JVN76024879/index.html"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/jp/JVN76024879/index.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
          }
        ],
        "sourceIdentifier": "vultures@jpcert.or.jp",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T12:17:14+00:00",
      "cve": "CVE-2022-33941",
      "id": "CVE-2022-33941",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2022-33941",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-33941.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2022-33941

Vulnerability from fkie_nvd - Published: 2022-09-08 08:15 - Updated: 2026-06-17 04:49

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN76024879/index.html	Third Party Advisory
vultures@jpcert.or.jp	https://www.powercms.jp/news/xmlrpc-api-provision-202208.html	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://jvn.jp/en/jp/JVN76024879/index.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.powercms.jp/news/xmlrpc-api-provision-202208.html	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
alfasado	powercms	*
alfasado	powercms	*
alfasado	powercms	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "PowerCMS XMLRPC API",
          "vendor": "Alfasado Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), PowerCMS 4.51 and earlier (PowerCMS 4 Series), and PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL)"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8260209D-6723-4FA5-8F94-55D35EA6F19A",
              "versionEndIncluding": "4.51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFE5A5A9-FDBC-49E9-8B1C-7B3ED1F56287",
              "versionEndIncluding": "5.21",
              "versionStartIncluding": "5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF7FF9CD-2DF1-43E6-A801-D50B806C8158",
              "versionEndIncluding": "6.021",
              "versionStartIncluding": "6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
    },
    {
      "lang": "es",
      "value": "La API PowerCMS XMLRPC proporcionada por Alfasado Inc. presenta una vulnerabilidad de inyecci\u00f3n de comandos.\u0026#xa0;El env\u00edo de un mensaje especialmente dise\u00f1ado mediante el m\u00e9todo POST a la API XMLRPC de PowerCMS puede permitir la ejecuci\u00f3n arbitraria de secuencias de comandos Perl y un comando arbitrario del Sistema Operativo puede ser ejecutado por medio de \u00e9l.\u0026#xa0;Los productos/versiones afectados son los siguientes: PowerCMS versiones 6.021 y anteriores (PowerCMS 6 Series), PowerCMS 5.21 y anteriores (PowerCMS 5 Series) y PowerCMS versiones 4.51 y anteriores (PowerCMS 4 Series).\u0026#xa0;Tenga en cuenta que todas las versiones de PowerCMS versiones 3 Series y anteriores que no son compatibles (fin de vida \u00fatil, EOL) tambi\u00e9n est\u00e1n afectadas por esta vulnerabilidad"
    }
  ],
  "id": "CVE-2022-33941",
  "lastModified": "2026-06-17T04:49:31.543",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-09-08T08:15:07.957",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/jp/JVN76024879/index.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/jp/JVN76024879/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-3GG6-G739-G8W9

Vulnerability from github – Published: 2022-09-09 00:00 – Updated: 2022-09-16 00:00

Details

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-33941"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-08T08:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.",
  "id": "GHSA-3gg6-g739-g8w9",
  "modified": "2022-09-16T00:00:29Z",
  "published": "2022-09-09T00:00:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33941"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN76024879/index.html"
    },
    {
      "type": "WEB",
      "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2022-33941

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-33941

Aliases

CVE-2022-33941

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-33941",
    "description": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.",
    "id": "GSD-2022-33941"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-33941"
      ],
      "details": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.",
      "id": "GSD-2022-33941",
      "modified": "2023-12-13T01:19:23.103682Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2022-33941",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "PowerCMS XMLRPC API",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), PowerCMS 4.51 and earlier (PowerCMS 4 Series), and PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL)"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Alfasado Inc."
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "OS Command Injection"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html",
            "refsource": "MISC",
            "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
          },
          {
            "name": "https://jvn.jp/en/jp/JVN76024879/index.html",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/jp/JVN76024879/index.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.021",
                "versionStartIncluding": "6.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.51",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5.21",
                "versionStartIncluding": "5.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2022-33941"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-77"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jvn.jp/en/jp/JVN76024879/index.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/en/jp/JVN76024879/index.html"
            },
            {
              "name": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-09-15T22:31Z",
      "publishedDate": "2022-09-08T08:15Z"
    }
  }
}

JVNDB-2022-000069

Vulnerability from jvndb - Published: 2022-09-02 06:49 - Updated:2024-06-13 02:44

Severity

9.8 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

PowerCMS XMLRPC API vulnerable to command injection

Details

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability (CWE-74). Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. According to the developer, it is unable to execute a command with an arbitrary value added to its argument, even if the vulnerability is exploited. Alfasado Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Alfasado Inc. coordinated under the Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN76024879/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2022-33941
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2022-33941
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

Alfasado Inc.

PowerCMS

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000069.html",
  "dc:date": "2024-06-13T11:44+09:00",
  "dcterms:issued": "2022-09-02T15:49+09:00",
  "dcterms:modified": "2024-06-13T11:44+09:00",
  "description": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability (CWE-74).\r\nSending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it.\r\nAccording to the developer, it is unable to execute a command with an arbitrary value added to its argument, even if the vulnerability is exploited.\r\n\r\nAlfasado Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Alfasado Inc. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000069.html",
  "sec:cpe": {
    "#text": "cpe:/a:alfasado:powercms",
    "@product": "PowerCMS",
    "@vendor": "Alfasado Inc.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "9.8",
      "@severity": "Critical",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-000069",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN76024879/index.html",
      "@id": "JVN#76024879",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-33941",
      "@id": "CVE-2022-33941",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-33941",
      "@id": "CVE-2022-33941",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "PowerCMS XMLRPC API vulnerable to command injection"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-33941 (GCVE-0-2022-33941)

FKIE_CVE-2022-33941

GHSA-3GG6-G739-G8W9

GSD-2022-33941

JVNDB-2022-000069

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour