CVE-2024-22033CWE-78

obs-service-download_url is vulnerable to argument injection

Medium · published October 16, 2024

CVSS v4.0
5.1
EPSS
1%
Percentile
59.8
In the wild
Unconfirmed
What it is

The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
EPSS
0.00916 · 59.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2024-10-16T13:42Z
EPSS history
Timeline
  • 16 OCT 13:42Z
    obs-service-download_url is vulnerable to argument injection
    cvelistv5