CVE-2022-33941

Name: CVE-2022-33941
Creator: NVD / NIST
Published: 2022-09-08T08:15:07.957+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 1.69%

Last modified Jun 17, 2026

CVE-2022-33941 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. EPSS estimates a 1.69% chance of exploitation in the next 30 days.

Description

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.69%

74.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-78

Affected Software

Vendor	Product	Versions
Alfasado	Powercms	<= 4.51
Alfasado	Powercms	>= 5.0, <= 5.21
Alfasado	Powercms	>= 6.0, <= 6.021

References

https://jvn.jp/en/jp/JVN76024879/index.htmlThird Party Advisory
https://www.powercms.jp/news/xmlrpc-api-provision-202208.htmlPatch, Vendor Advisory
https://jvn.jp/en/jp/JVN76024879/index.htmlThird Party Advisory
https://www.powercms.jp/news/xmlrpc-api-provision-202208.htmlPatch, Vendor Advisory

Timeline

Published: Sep 8, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-33941?

How severe is CVE-2022-33941?

CVE-2022-33941 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.69% probability of exploitation in the next 30 days.

How do I fix CVE-2022-33941?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-33941?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST