CVE-2022-26111: canon irisnext Expression Language Injection

Vulnerability summary

CVE-2022-26111 is a high (CVSS 9.0) Expression Language Injection vulnerability in canon irisnext. EPSS estimates a 4.19% chance of exploitation in the next 30 days, higher than 90.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-04-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an existing/predefined search) of the documents. The search components permit adding BeanShell expressions that result in Remote Code Execution in the context of the IRISNext application user, running on the web server.

• CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.