CVE-2022-24881

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-24881

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24881.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2022-24881

Aliases

GHSA-fv3m-xhqw-9m79

Published

2022-04-26T16:06:21Z

Modified

2026-10-06T02:26:25Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Command Injection in Ballcat Codegen

Details

Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24881.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "1.0.0.beta.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/ballcat-projects/ballcat-codegen

Affected ranges

Type

GIT

Repo

https://github.com/ballcat-projects/ballcat-codegen

Events

Introduced

Fixed

84a7cb38daf0295b93aba21d562ec627e4eb463b

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24881.json"