CVE-2024-56333CWE-94

Remote code execution in onyxia-api

Critical · published December 20, 2024

CVSS v4.0
9.4
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientists. This critical vulnerability allows authenticated users to remotely execute code within the Onyxia-API, leading to potential consequences such as unauthorized access to other user environments and denial of service attacks. This issue has been patched in api versions 4.2.0, 3.1.1, and 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00650 · 50.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-12-20T19:52Z
EPSS history
Timeline
  • 20 DEC 19:52Z
    Remote code execution in onyxia-api
    cvelistv5