Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2022-24441— Code Injection

CVSS 5.8 · Medium EPSS 1.64% · P82
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-24441

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Code Injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Snyk CLI 操作系统命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Snyk CLI是美国Snyk公司的一个构建时工具，用于查找和修复项目中的已知漏洞。 Snyk CLI1.1064.0之前版本存在操作系统命令注入漏洞。攻击者利用该漏洞执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-snyk unspecified ~ 1.1064.0 -

II. Public POCs for CVE-2022-24441

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-24441

请登录查看更多情报信息。

Same Patch Batch · n/a · 2022-11-30 · 21 CVEs total

CVE-2022-229845.0 MEDIUMCommand Injection
CVE-2022-46338g810-led 安全漏洞
CVE-2021-31740SEPPmail 跨站脚本漏洞
CVE-2022-45869Linux kernel 竞争条件问题漏洞
CVE-2022-45337Tenda TX9 Pro 缓冲区错误漏洞
CVE-2022-45332LibreDWG 缓冲区错误漏洞
CVE-2022-45328Church Management System SQL注入漏洞
CVE-2022-44296Sanitization Management System SQL注入漏洞
CVE-2022-44295Sanitization Management System SQL注入漏洞
CVE-2022-44294Sanitization Management System SQL注入漏洞
CVE-2022-44151Simple Inventory Management System SQL注入漏洞
CVE-2022-44136Zenario CMS 安全漏洞
CVE-2022-44097Book Store Management System 信任管理问题漏洞
CVE-2022-44096Sanitization Management System 信任管理问题漏洞
CVE-2022-41413perfSONAR 跨站请求伪造漏洞
CVE-2022-41412perfSONAR 代码问题漏洞
CVE-2022-38803Zkteco BioTime 跨站脚本漏洞
CVE-2022-38802Zkteco BioTime 跨站脚本漏洞
CVE-2022-38801Zkteco BioTime 跨站脚本漏洞
CVE-2022-23746Check Point IPSec VPN 安全漏洞

IV. Related Vulnerabilities

Same product: snyk
Same vendor: n/a

V. Comments for CVE-2022-24441

No comments yet

Leave a comment