CVE-2024-2243CWE-78

Csmock: command injection vulnerability in csmock-plugin-snyk

High · published April 10, 2024

CVSS v3.1
7.6
EPSS
1%
Percentile
64.1
In the wild
Unconfirmed
What it is

A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01053 · 64.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2024-04-10T10:14Z
EPSS history
Timeline
  • 10 APR 10:14Z
    Csmock: command injection vulnerability in csmock-plugin-snyk
    cvelistv5