Vulnerability in cdxgen Allows Execution of Code in Build-Related Files
CVE-2024-50611

Currently unrated

Key Information:

Vendor: CycloneDX
Vendor: CVE Published:; 27 October 2024

What is CVE-2024-50611?

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.

References

https://github.com/CycloneDX/cdxgen/releases

https://github.com/CycloneDX/cdxgen/issues/1328

https://owasp.org/www-project-dep-scan/

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 27, 2024
Vulnerability Reserved
Oct 27, 2024