exploitDog

CVE-2024-42166

Опубликовано: 12 авг. 2024

Источник: nvd

CVSS3: 9.1

CVSS3: 7.2

EPSS Низкий

Описание

The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name.

Ссылки

https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*

Версия до 8.4 (включая)

EPSS

Процентиль: 48%

0.00249

Низкий

9.1 Critical

CVSS3

7.2 High

CVSS3

Дефекты

CWE-78

CWE-78

Связанные уязвимости

GHSA-3949-74rr-85j5

CVSS3: 9.1

github

больше 1 года назад

The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name.

EPSS

Процентиль: 48%

0.00249

Низкий

9.1 Critical

CVSS3

7.2 High

CVSS3

Дефекты

CWE-78

CWE-78