CVE-2024-2243 Csmock: command injection vulnerability in csmock-plugin-snyk

2024-04-1010:14:47

CWE-78

fedora

raw.githubusercontent.com

cve-2024-2243

csmock

command injection

vulnerability

disclosure

osh service

kerberos

snyk

authentication token

arbitrary commands

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers.