Lucene search

GitHub Advisory DatabaseGHSA-W9H2-PX87-74VX

HistoryJan 30, 2024 - 8:56 p.m.

vantage6 remote code execution vulnerability

2024-01-3020:56:45

CWE-94

GitHub Advisory Database

github.com

vantage6

remote code execution

vulnerability

authenticated users

inject code

algorithm environment variables

no software workarounds

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

43.8%

JSON

Impact

Authenticated users could inject code into algorithm environment variables

Workarounds

Affected configurations

Vulners

Node

vantage6vantage6Range<4.2.0

VendorProductVersionCPE
vantage6vantage6*cpe:2.3:a:vantage6:vantage6:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vantage6	vantage6	*	cpe:2.3:a:vantage6:vantage6::::::::

References

github.com/advisories/GHSA-w9h2-px87-74vx

github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2024-30.yaml

github.com/vantage6/vantage6/commit/eac19db737145d3ca987adf037a454fae0790ddd

github.com/vantage6/vantage6/security/advisories/GHSA-w9h2-px87-74vx

nvd.nist.gov/vuln/detail/CVE-2024-21649

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

43.8%

JSON

Related for GHSA-W9H2-PX87-74VX