exploitDog

CVE-2024-42167

Опубликовано: 12 авг. 2024

Источник: nvd

CVSS3: 9.1

CVSS3: 7.2

EPSS Низкий

Описание

The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname.

Ссылки

https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*

Версия до 8.4 (включая)

EPSS

Процентиль: 48%

0.00249

Низкий

9.1 Critical

CVSS3

7.2 High

CVSS3

Дефекты

CWE-78

CWE-78

Связанные уязвимости

GHSA-fvfg-7v3r-g9v3

CVSS3: 9.1

github

больше 1 года назад

The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname.

EPSS

Процентиль: 48%

0.00249

Низкий

9.1 Critical

CVSS3

7.2 High

CVSS3

Дефекты

CWE-78

CWE-78