Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:45963
HistoryMar 21, 2024 - 9:14 a.m.

Arbitrary Code Execution

2024-03-2109:14:56
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
arbitrary code execution
qiskit_ibm_runtime
json data deserialization
input validation
runtimedecoder

5.3 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

qiskit_ibm_runtime is vulnerable to Arbitrary Code Execution. The vulnerability is due to insufficient input validation during the deserialization of JSON data using qiskit_ibm_runtime.RuntimeDecoder. This lack of proper validation allows an attacker to craft malicious input strings that, when deserialized, could result in the execution of arbitrary code.

5.3 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

7.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

Related for VERACODE:45963