CVE-2024-50492

Improper Control of Generation of Code ('Code Injection') (CWE-94)

Published: Oct 28, 2024 / Updated: 22d ago

010
CVSS 9.8EPSS 0.04%Critical
CVE info copied to clipboard

Summary

Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart allows Code Injection. This issue affects ScottCart versions up to and including 1.1.

Impact

This vulnerability has a critical impact on the affected systems. With a CVSS v3.1 base score of 9.8, it poses a severe risk. The vulnerability allows for code injection, which can lead to unauthorized code execution on the target system. The impact is high across all three main security aspects: 1. Confidentiality: High impact, potentially allowing attackers to access sensitive information. 2. Integrity: High impact, enabling attackers to modify or inject malicious code, compromising the system's trustworthiness. 3. Availability: High impact, potentially allowing attackers to disrupt normal operations or cause system downtime. The attack vector is network-based, requires no user interaction, and can be executed with low attack complexity, making it relatively easy for attackers to exploit.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the latest information provided, there is no mention of a specific patch being available. The vulnerability affects ScottCart versions up to and including 1.1, suggesting that users should look for updates beyond this version or await an official patch from Scott Paterson.

Mitigation

Given the severity of this vulnerability, immediate action is recommended: 1. Update ScottCart: If a version newer than 1.1 is available, update immediately after thorough testing. 2. Implement Web Application Firewall (WAF): Configure rules to detect and block code injection attempts. 3. Input Validation: Enforce strict input validation on all user-supplied data to prevent code injection. 4. Least Privilege: Ensure the application runs with minimal necessary permissions to limit the impact of successful exploits. 5. Network Segmentation: Isolate systems running ScottCart to minimize the potential spread of an attack. 6. Monitoring: Implement robust logging and monitoring to detect potential exploitation attempts. 7. Temporary Measures: If immediate patching is not possible, consider temporarily disabling the affected component or restricting access to trusted IP addresses only. Prioritize this vulnerability for immediate attention due to its high severity score and the potential for significant impact on affected systems.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-50492. See article

Oct 28, 2024 at 11:58 AM / Vulners.com RSS Feed
CVE Assignment

NVD published the first details for CVE-2024-50492

Oct 28, 2024 at 12:15 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 28, 2024 at 12:21 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.9%)

Oct 29, 2024 at 9:43 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 31, 2024 at 1:15 AM / nvd
Static CVE Timeline Graph

Affected Systems

Scottpaterson/scottcart
+null more

Attack Patterns

CAPEC-242: Code Injection
+null more

News

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 21, 2024 to October 27, 2024)
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week: WordPress Plugins with Reported Vulnerabilities Last Week
Security Bulletin 30 Oct 2024 - Cyber Security Agency of Singapore
A vulnerability in the SSH subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to execute ...
CVE-2024-50492
High Severity Description Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart allows Code Injection.This issue affects ScottCart: from n/a through 1.1. Read more at https://www.tenable.com/cve/CVE-2024-50492
NA - CVE-2024-50492 - Improper Control of Generation of Code...
Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart allows Code Injection.This issue affects ScottCart: from n/a through 1.1.
cveNotify : 🚨 CVE-2024-50492Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart allows Code Injection.This issue affects ScottCart: from n/a through 1.1.🎖@cveNotify
cveNotify : 🚨 CVE-2024-50492Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart allows Code Injection.This issue affects ScottCart: from n/a through 1.1.🎖@cveNotify
See 7 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI