Improper Input Validation (CWE-20)
ACON, a widely-used library of tools for machine learning focusing on adaptive correlation optimization, has a potential vulnerability in its input validation process. This could lead to arbitrary code execution if exploited. The issue allows an attacker to submit malicious input data, bypassing input validation, resulting in remote code execution in certain machine learning applications using the ACON library.
This vulnerability could allow attackers to execute arbitrary code remotely on systems running applications that use the ACON library. All users utilizing ACON's input-handling functions are potentially at risk, with machine learning models or applications that ingest user-generated data without proper sanitization being the most vulnerable. Users running ACON on production servers are at heightened risk, as the vulnerability could be exploited remotely. The potential impacts include unauthorized access to systems, data breaches, and compromise of the affected machine learning applications and their host systems.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
As of the time of publication, it is unclear whether a fix is available.
While no specific patch is mentioned, potential mitigation strategies could include: 1. Implementing strict input validation and sanitization for all data processed by ACON, especially user-generated input. 2. Limiting the exposure of applications using ACON, particularly those processing user input, to untrusted networks. 3. Monitoring systems for unusual activity that could indicate exploitation attempts. 4. Considering the use of additional security layers, such as Web Application Firewalls (WAF), to filter potentially malicious inputs. 5. Regularly checking for updates from the ACON developers and applying any security patches as soon as they become available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD published the first details for CVE-2024-49361
A CVSS base score of 8.1 has been assigned.
Feedly found the first article mentioning CVE-2024-49361. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 9.7%)