CVE-2024-52959CWE-94

iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')

Critical · published November 27, 2024

CVSS v4.0
9.3
EPSS
1%
Percentile
46.0
In the wild
Unconfirmed
What it is

A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H
EPSS
0.00562 · 46.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-11-27T05:23Z
EPSS history
Timeline
  • 27 NOV 05:23Z
    iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')
    cvelistv5