by Kastro
Paper/Archive/CVE-2024-6917

CVE-2024-6917

Veribilim Software Veribase Order Management — RCE in Veribilim Software's Veribase Order Management

EPSS 1%CVSS 10.0
critical.is priorityof 100
44
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 70.6.706 × 2014.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection. This issue affects Veribase Order Management: before v4.010.2.

Affected

ProductAffectedFixed inSource
Veribase Order Management< v4.010.2v4.010.2CNA
veribase_order_management< 4.010.24.010.2CISA-ADP

Scores by source

TR-CERT (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-24-1105refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1105