Arbitrary Shell Commands Execution Vulnerability
CVE-2024-10224

5.3MEDIUM

Key Information:

Vendor

Module::scandeps

Status
Module::scandeps
Vendor
CVE Published:
19 November 2024

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2024-10224?

A security vulnerability exists within the Modules::ScanDeps library developed by Qualys. If an attacker provides unsanitized input, specifically through methods such as open() by using a 'pesky pipe' via filename or passing arbitrary strings to eval(), it could lead to the execution of arbitrary shell commands by a local attacker. This flaw emphasizes the importance of thorough input validation and sanitization to prevent unauthorized command execution and protect system integrity.

Affected Version(s)

Module::ScanDeps Linux 0 < 1.38

News Articles

favicon imageSC Media

Ubuntu affected by 10-year-old flaws in needrestart package

The five vulnerabilities could lead to local privilege escalation without user interaction.

favicon imageThe Hacker News

Decades-Old Security Vulnerabilities Found in Ubuntu's Needrestart Package

Critical Ubuntu needrestart flaws allow local root privilege escalation; update immediately to safeguard systems.

References

https://www.cve.org/CVERecord?id=CVE-2024-10224
issue-tracking
https://github.com/rschupp/Module-ScanDeps/security/advis...
vendor-advisory
https://www.qualys.com/2024/11/19/needrestart/needrestart...
third-party-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

Credit

Qualys
Roderich Schupp
Mark Esler
.
CVE-2024-10224 : Arbitrary Shell Commands Execution Vulnerability