Regex Matches on Authorized Commands and Arguments Not Properly Enforced
CVE-2024-49400

9.8CRITICAL

Key Information:

Vendor

Meta

Status
Tacquito
Vendor
CVE Published:
17 October 2024

What is CVE-2024-49400?

The Tacquito application, before commit 07b49d1358e6ec0b5aa482fcd284f509191119e2, is vulnerable due to improper handling of regex matches for authorized commands and arguments. This mishandling allows for commands to be partially matched rather than requiring a complete match, which poses a risk of executing unauthorized commands, thereby compromising the application's security.

Affected Version(s)

Tacquito 0 < 07b49d1358e6ec0b5aa482fcd284f509191119e2

References

https://www.facebook.com/security/advisories/cve-2024-49400
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.