CVE-2024-48963 | THREATINT

Description

The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.

Reserved 2024-10-10 | Published 2024-10-23 | Updated 2024-10-24 | Assigner snyk

HIGH: 7.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NHIGH: 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Any version before 1.1294.0

affected

Any version before 1.10.0

affected

References

github.com/snyk/snyk-php-plugin/releases/tag/v1.10.0

cve.org (CVE-2024-48963)

nvd.nist.gov (CVE-2024-48963)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.