CVE-2024-12652CWE-94

Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')

Critical · published December 26, 2024

CVSS v4.0
9.3
EPSS
1%
Percentile
55.4
In the wild
Unconfirmed
What it is

A Improper Control of Generation of Code ('Code Injection') vulnerability in groovy script function in SmartRobot′s Conversational AI Platform before v7.2.0 allows remote authenticated users to perform arbitrary system commands via Groovy code.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H
EPSS
0.00779 · 55.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-12-26T04:05Z
EPSS history
Timeline
  • 26 DEC 04:05Z
    Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')
    cvelistv5