Vulnerability in cdxgen Allows Execution of Code in Build-Related Files
CVE-2024-50611

7.2HIGH

Key Information:

Vendor

CycloneDX

Status
cdxgen
Vendor
CVE Published:
27 October 2024

What is CVE-2024-50611?

The CycloneDX cdxgen tool, prior to version 10.10.7, presents a vulnerability that can lead to arbitrary code execution when processing untrusted codebases. This issue arises from build-related files, such as build.gradle.kts, which may inadvertently execute harmful code during dependency scanning. Notably, this situation has been identified as a design limitation rather than a flaw in the implementation. Users of the OWASP Dependency Scanner should be aware of this risk when using cdxgen in their environments.

References

https://github.com/CycloneDX/cdxgen/releases
https://github.com/CycloneDX/cdxgen/issues/1328
https://owasp.org/www-project-dep-scan/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.