CVE-2024-39703

Summary

In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API endpoint.

Affected Software

Weaknesses

• CWE-77: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://threatq.freshdesk.com/helpdesk/tickets/10367
• https://www.threatq.com/vulnerability-management/
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-01

• ←Previous
• Next→