CVE-2024-42360

2024-08-1420:15:12

CWE-77

GitHub_M

web.nvd.nist.gov

sequenceserver

blast+ server

vulnerability

fixed

http endpoints

user input

query parameters

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

wurmlabsequenceserverRange<3.1.2ruby

VendorProductVersionCPE
wurmlabsequenceserver*cpe:2.3:a:wurmlab:sequenceserver:*:*:*:*:*:ruby:*:*

Vendor	Product	Version	CPE
wurmlab	sequenceserver	*	cpe:2.3:a:wurmlab:sequenceserver::::::ruby::*

CNA Affected

[
  {
    "vendor": "wurmlab",
    "product": "sequenceserver",
    "versions": [
      {
        "version": "< 3.1.2",
        "status": "affected"
      }
    ]
  }
]