CVE-2024-36360 - Vulnerability Details - OpenCVE

OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Keisuke Nakayama	Awkblog

No data.

No data.

References

Link	Providers
https://github.com/yammerjp/awkblog/issues/1
https://jvn.jp/en/jp/JVN80506242/

History

Fri, 14 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Keisuke Nakayama Keisuke Nakayama awkblog
Weaknesses		CWE-78
CPEs		cpe:2.3:a:keisuke_nakayama:awkblog::::::::
Vendors & Products		Keisuke Nakayama Keisuke Nakayama awkblog
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-06-11T04:19:39.122Z

Updated: 2025-03-14T14:43:00.422Z

Reserved: 2024-05-24T02:04:55.207Z

Link: CVE-2024-36360

Vulnrichment

Updated: 2024-08-02T03:37:04.935Z

NVD

Status : Awaiting Analysis

Published: 2024-06-11T05:15:53.610

Modified: 2025-03-14T15:15:41.037

Link: CVE-2024-36360

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36360", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-05-24T02:04:55.207Z", "datePublished": "2024-06-11T04:19:39.122Z", "dateUpdated": "2025-03-14T14:43:00.422Z"}, "containers": {"cna": {"affected": [{"vendor": "Keisuke Nakayama", "product": "awkblog", "versions": [{"version": "v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product."}], "problemTypes": [{"descriptions": [{"description": "OS command injection", "lang": "en", "type": "text"}]}], "references": [{"url": "https://github.com/yammerjp/awkblog/issues/1"}, {"url": "https://jvn.jp/en/jp/JVN80506242/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-06-11T04:19:39.122Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "affected": [{"vendor": "keisuke_nakayama", "product": "awkblog", "cpes": ["cpe:2.3:a:keisuke_nakayama:awkblog:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-11T15:44:36.276647Z", "id": "CVE-2024-36360", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T14:43:00.422Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:04.935Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/yammerjp/awkblog/issues/1", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN80506242/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/yammerjp/awkblog/issues/1", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN80506242/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:04.935Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36360", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-11T15:44:36.276647Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:keisuke_nakayama:awkblog:*:*:*:*:*:*:*:*"], "vendor": "keisuke_nakayama", "product": "awkblog", "versions": [{"status": "affected", "version": "v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T15:48:00.998Z"}}], "cna": {"affected": [{"vendor": "Keisuke Nakayama", "product": "awkblog", "versions": [{"status": "affected", "version": "v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier"}]}], "references": [{"url": "https://github.com/yammerjp/awkblog/issues/1"}, {"url": "https://jvn.jp/en/jp/JVN80506242/"}], "descriptions": [{"lang": "en", "value": "OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "OS command injection"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-06-11T04:19:39.122Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36360", "state": "PUBLISHED", "dateUpdated": "2025-03-14T14:43:00.422Z", "dateReserved": "2024-05-24T02:04:55.207Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-06-11T04:19:39.122Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}