CVE-2024-2243

2024-04-1011:15:49

CWE-78

[email protected]

web.nvd.nist.gov

organization

individual

nvd

security problem

7.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.6%

JSON

A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers.

CNA Affected

[
  {
    "versions": [
      {
        "status": "unaffected",
        "version": "3.5.3"
      },
      {
        "status": "affected",
        "version": "3.5.2"
      },
      {
        "status": "affected",
        "version": "3.5.1"
      }
    ],
    "packageName": "csmock",
    "collectionURL": "https://github.com/csutils/csmock",
    "defaultStatus": "unaffected"
  }
]