Lucene search
HistoryJan 16, 2024 - 6:15 p.m.
CVE-2024-23347
meta spark studio
v176
vulnerability
executing
arbitrary code
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
23.1%
Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application.
Affected configurations
Node
facebookmeta_spark_studioRange<176
| Vendor | Product | Version | CPE |
|---|---|---|---|
| meta_spark_studio | * | cpe:2.3:a:facebook:meta_spark_studio:*:*:*:*:*:*:*:* |
Related
cve
cve
CVE-2024-23347
2024-01-16 18:15:11
prion
prion
Authorization
2024-01-16 18:15:00
cvelist
cvelist
CVE-2024-23347
2024-01-16 17:57:20
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
23.1%
Related for NVD:CVE-2024-23347