CVE-2024-3566

Опубликовано: 10 апр. 2024

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Ссылки

https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
Exploit
Third Party Advisory
https://kb.cert.org/vuls/id/123335
Third Party Advisory
https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way
Technical Description
https://www.cve.org/CVERecord?id=CVE-2024-1874
Not Applicable
https://www.cve.org/CVERecord?id=CVE-2024-22423
Not Applicable
https://www.cve.org/CVERecord?id=CVE-2024-24576
Not Applicable
https://www.kb.cert.org/vuls/id/123335
Not Applicable
https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
Exploit
Third Party Advisory
https://kb.cert.org/vuls/id/123335
Third Party Advisory
https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way
Technical Description
https://www.cve.org/CVERecord?id=CVE-2024-1874
Not Applicable
https://www.cve.org/CVERecord?id=CVE-2024-22423
Not Applicable
https://www.cve.org/CVERecord?id=CVE-2024-24576
Not Applicable
https://www.kb.cert.org/vuls/id/123335
Not Applicable

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

cpe:2.3:a:haskell:process_library:1.6.19.0:*:*:*:*:*:*:*

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия до 21.7.2 (включая)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

cpe:2.3:a:rust-lang:rust:1.77.2:*:*:*:*:*:*:*

cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.00873

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-77

Связанные уязвимости

CVE-2024-3566

CVSS3: 9.8

debian

около 1 года назад

A command inject vulnerability allows an attacker to perform command i ...

GHSA-9xch-xvj3-fmf3

CVSS3: 9.8

github

около 1 года назад

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

EPSS

Процентиль: 74%

0.00873

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-77