by Kastro
Paper/Archive/CVE-2024-22836

CVE-2024-22836

mitre — An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier.

EPSS 30%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.2.982 × 2019.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/akaunting/akaunting/releases/tag/3.1.4refakaunting.comrefgithub.com/u32i/cve/tree/main/CVE-2024-22836