CVE-2022-37027

HIGH

Ahsay Cloud Backup Suite - Remote Code Execution

Title source: rule

Description

Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.

References (5)

[Release Notes, Vendor Advisory] https://wiki.ahsay.com/doku.php?id=public:resources:release_notes_v9320

[Product, Vendor Advisory] https://www.ahsay.com/jsp/en/downloads/ahsay-downloads_latest-software_ahsaycbs.jsp

[Permissions Required, Vendor Advisory] https://www.ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_latest_hotfix

[Third Party Advisory] https://www.compass-security.com/en/research/advisories

[Exploit, Third Party Advisory] https://www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txt

Scores

CVSS v3 7.2

EPSS 0.0621

EPSS Percentile 90.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-88

Status published

Affected Products (1)

ahsay/cloud_backup_suite

Timeline

Published Sep 21, 2022

Tracked Since Feb 18, 2026