Описание
An issue was discovered in report_edit.jsp in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:determine:contract_lifecycle_management:5.4:*:*:*:*:*:*:*
EPSS
Процентиль: 76%
0.00932
Низкий
8.8 High
CVSS3
9 Critical
CVSS2
Дефекты
CWE-94
Связанные уязвимости
github
больше 3 лет назад
An issue was discovered in report_edit.jsp in Determine (formerly Selectica) Contract Lifecycle Management (CLM) v5.4. Any authenticated user may execute Groovy code when generating a report, resulting in arbitrary code execution on the underlying server.
EPSS
Процентиль: 76%
0.00932
Низкий
8.8 High
CVSS3
9 Critical
CVSS2
Дефекты
CWE-94