Lucene search

Veracode Vulnerability DatabaseVERACODE:45241

HistoryJan 31, 2024 - 6:04 a.m.

Remote Code Execution (RCE)

2024-01-3106:04:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vantage6

remote code execution

vulnerability

environment variables

authenticated user

injection

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.8%

JSON

vantage6 is vulnerable to Remote Code Execution (RCE). The vulnerability is due to improper sanitization of environment variables. An authenticated user can inject code via environment variables, resulting in RCE.

CPENameOperatorVersion
vantage6le4.1.3
vantage6le4.1.3

CPE	Name	Operator	Version
	vantage6	le	4.1.3
	vantage6	le	4.1.3

References

github.com/vantage6/vantage6/commit/eac19db737145d3ca987adf037a454fae0790ddd

github.com/vantage6/vantage6/security/advisories/GHSA-w9h2-px87-74vx

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.8%

JSON

Related for VERACODE:45241