CVE-2022-37767: pebbletemplates pebble_templates Incorrect Authorization
Vulnerability summary
CVE-2022-37767 is a critical (CVSS 9.8) Incorrect Authorization vulnerability in pebbletemplates pebble_templates. EPSS estimates a 1.48% chance of exploitation in the next 30 days, higher than 73.4% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 12-09-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.
CVSS metrics
2 scores · 2 sources · 1 version- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.48%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
+0.03 pp
From 1.44% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundWeb Security
Maturity: poc
Pebble
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Io.pebbletemplates1 product
- pebble≤ 3.1.5
Pebbletemplates1 product
- pebble_templates3.1.5
2 vendors · 2 products
