Paper/Archive/CVE-2024-48963

CVE-2024-48963

Snyk Snyk Cli — The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project.

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 40.6.406 × 208.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.

Affected

ProductAffectedFixed inSource

Snyk Cli< 1.1294.01.1294.0CNA

Snyk PHP Plugin< 1.10.01.10.0CNA

snyk_cli< 1.1294.01.1294.0CISA-ADP

snyk_php_plugin< 1.10.01.10.0CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

snyk (CNA)7.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

snyk (CNA)7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/snyk/snyk-php-plugin/releases/tag/v1.10.0