Paper/Archive/CVE-2024-52959

CVE-2024-52959

Galaxy Software Services Corporation iota C.ai Conversational Platform — iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')

EPSS 0.6%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 46.7.467 × 209.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file.

Affected

ProductAffectedFixed inSource

iota C.ai Conversational Platform1.0.0 – 2.1.3–CNA

iota_c.ai_conversational_platform1.0.0 – 2.1.3–CISA-ADP

Scores by source

ZUSO ART (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupzuso.ai/advisory/za-2024-12