Paper/Archive/CVE-2024-12652

CVE-2024-12652

Intumit SmartRobot′s Conversational AI Platform — Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')

EPSS 0.8%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 55.9.559 × 2011.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A Improper Control of Generation of Code ('Code Injection') vulnerability in groovy script function in SmartRobot′s Conversational AI Platform before v7.2.0 allows remote authenticated users to perform arbitrary system commands via Groovy code.

Affected

ProductAffectedFixed inSource

SmartRobot′s Conversational AI Platform< v7.2.0v7.2.0CNA

Scores by source

ZUSO ART (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupzuso.ai/advisory/za-2024-13