CVE-2024-5023
Assigner: netflix
Published: 2024-05-16T18:05:40.240Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: ConsoleMe
repo: https://github.com/Netflix/consoleme/
vendor: Netflix
versions: lessThan: 1.4.0
status: affected
version: 0
versionType: git
datePublic: 2024-05-16T18:01:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.<p>This issue affects ConsoleMe: before 1.4.0.</p>
value: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Netflix ConsoleMe allows Command Injection.This issue affects ConsoleMe: before 1.4.0.
impacts: capecId: CAPEC-248
descriptions: value: CAPEC-248 Command Injection
metrics: cvssV4_0: Automatable: NOT_DEFINED
Recovery: NOT_DEFINED
Safety: NOT_DEFINED
attackComplexity: LOW
attackRequirements: NONE
attackVector: NETWORK
baseScore: 9.3
baseSeverity: CRITICAL
privilegesRequired: LOW
providerUrgency: NOT_DEFINED
subAvailabilityImpact: NONE
subConfidentialityImpact: HIGH
subIntegrityImpact: HIGH
userInteraction: NONE
valueDensity: NOT_DEFINED
vectorString: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
version: 4.0
vulnAvailabilityImpact: NONE
vulnConfidentialityImpact: HIGH
vulnIntegrityImpact: HIGH
vulnerabilityResponseEffort: NOT_DEFINED
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
type: CWE
source: discovery: UNKNOWN
title: Arbitrary File Read Vulnerability in ConsoleMe via Limited Git command RCE
x_generator: engine: Vulnogram 0.2.0