CVE Feed

    Dashboard / CVE / CVE-2022-37027

    CVE-2022-37027

    Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. Administrators that can modify the Runtime Options in the web interface can inject Java Runtime Options. These take effect after a restart. For example, an attacker can enable JMX services and consequently achieve remote code execution as the system user.

    Published:Sep 21, 2022
    Last Modified:May 28, 2025
    EPS:Sep 21, 2022
    EPSS Score:0.33751
    CVSS Score:7.2

    Affected Products

    Vendor
    Ahsay
    Product
    Cloud Backup Suite

    Exploits

    https://www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txthttps://www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txt

    Related CVEs

    CVE-2020-5846 (CVSS 8.8) — An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PU…
    CVE-2019-10267 (CVSS 8.8) — An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is po…
    CVE-2019-10266 (CVSS 7.5) — An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML documen…
    CVE-2019-10265 (CVSS 7.5) — An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. On the /cbs/system/ShowAdvanced.do "File …
    CVE-2019-10264 (CVSS 7.2) — An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. With a valid administrator account, the "…
    CVE-2019-10263 (CVSS 6.1) — An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is poss…

    References

    https://wiki.ahsay.com/doku.php?id=public:resources:release_notes_v9320
    https://www.ahsay.com/jsp/en/downloads/ahsay-downloads_latest-software_ahsaycbs.jsp
    https://www.ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_latest_hotfix
    https://www.compass-security.com/en/research/advisories
    https://www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txt
    https://wiki.ahsay.com/doku.php?id=public:resources:release_notes_v9320
    https://www.ahsay.com/jsp/en/downloads/ahsay-downloads_latest-software_ahsaycbs.jsp
    https://www.ahsay.com/partners/en/home/index.jsp?pageContentKey=ahsay_assets_latest_hotfix
    https://www.compass-security.com/en/research/advisories
    https://www.compass-security.com/fileadmin/Research/Advisories/2022_12_CSNC-2022-009_AhsayCBS_Java_Runtime_Parameter_Injection.txt

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High