CVE-2024-29189CWE-78

ansys-geometry-core OS Command Injection vulnerability

High · published March 26, 2024

CVSS v3.1
7.4
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00337 · 25.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2024-03-26T02:50Z
EPSS history
Timeline
  • 26 MAR 02:50Z
    ansys-geometry-core OS Command Injection vulnerability
    cvelistv5