CVE-2024-36360

CRITICAL

9.8

Beschreibung

OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht6/11/2024

Zuletzt geandert3/14/2025

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-78

Referenzen

https://github.com/yammerjp/awkblog/issues/1(vultures@jpcert.or.jp)

https://jvn.jp/en/jp/JVN80506242/(vultures@jpcert.or.jp)

https://github.com/yammerjp/awkblog/issues/1(af854a3a-2127-422b-91ae-364da2661108)

https://jvn.jp/en/jp/JVN80506242/(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.