CVE-2022-23330

HIGH

A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR package.

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS1.9%
Percentile80th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
◆ AI Analysis — automated analysis, not human-reviewed

A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR package.

BSID: BS-2022-GLOBAL-070844-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-23330?
A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR package.
What is the CVSS score for CVE-2022-23330?
CVE-2022-23330 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.9%.
Is CVE-2022-23330 actively exploited?
No confirmed active exploitation of CVE-2022-23330 as of 2026-09-25.
How do I remediate CVE-2022-23330?
Priority: IMMEDIATE.
What systems are affected by CVE-2022-23330?
CVE-2022-23330 affects Jpress Jpress.
Vulnerability Details
CVE IDCVE-2022-23330
BSIDBS-2022-GLOBAL-070844-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2022-02-04
Last Modified2026-06-17
ICS Relevance0%
SourceNVD
Official Description

A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR package.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists in the HelloWorldAddonController.java file of jpress v4.2.0. Attackers can exploit this by uploading a malicious JAR package, which can then be executed on the server, leading to arbitrary code execution.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Jpress Jpress 4.2.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1714 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash6c00b8ad7aff8631f466351dbbed26dbefaeab1db1a4c163ce2b7c291484c7d75e8c2837584158fc62d360169fd9818a0dd88354112d9df5b79cb5bfce4e498a
Related CVEs affecting Jpress
CVE-2021-45807 9.8 jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._Add... CVE-2024-50919 9.8 Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and t... CVE-2021-46114 8.8 jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotif... CVE-2021-45806 8.8 jpress v4.2.0 admin panel provides a function through which attackers can mod... CVE-2021-45808 8.8 jpress v4.2.0 allows users to register an account by default. With the accoun...
View all Jpress CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →