CVE-2024-51661

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: Nov 4, 2024 / Updated: 15d ago

010
CVSS 7.2EPSS 0.04%High
CVE info copied to clipboard

Summary

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in David Lingren Media Library Assistant. This vulnerability allows for Command Injection, potentially giving attackers the ability to execute arbitrary commands on the affected system.

Impact

This vulnerability has a high severity with a CVSS v3.1 base score of 9.1, indicating a critical risk. The impact is severe across confidentiality, integrity, and availability, all rated as HIGH. The vulnerability can be exploited remotely (Network attack vector) without user interaction, and despite requiring high privileges, it can change the scope of the attack. This means attackers who gain access could potentially escalate their privileges and impact other components beyond the vulnerable component's security scope. Successful exploitation could lead to unauthorized command execution, potentially resulting in complete system compromise, data theft, system manipulation, or service disruption.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is not explicitly mentioned in the provided information. However, the vulnerability affects Media Library Assistant versions from an unspecified starting point through version 3.19. It's crucial to check for updates beyond version 3.19 that may address this vulnerability.

Mitigation

1. Update Media Library Assistant to a version newer than 3.19 if available. 2. If an update is not available, consider temporarily disabling or restricting access to Media Library Assistant until a patch is released. 3. Implement strong input validation and sanitization mechanisms to prevent command injection attacks. 4. Apply the principle of least privilege to limit the potential impact of successful exploitation. 5. Use web application firewalls (WAF) or similar security tools to detect and block potential OS command injection attempts. 6. Regularly monitor system logs for any suspicious activities that might indicate exploitation attempts.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-51661

Nov 4, 2024 at 11:15 AM
CVSS

A CVSS base score of 9.1 has been assigned.

Nov 4, 2024 at 11:20 AM / nvd
First Article

Feedly found the first article mentioning CVE-2024-51661. See article

Nov 4, 2024 at 11:22 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 4, 2024 at 11:22 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.6%)

Nov 5, 2024 at 10:05 AM
CVSS

A CVSS base score of 7.2 has been assigned.

Nov 8, 2024 at 3:05 PM / nvd
Static CVE Timeline Graph

Affected Systems

Davidlingren/media_library_assistant
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

News

US-CERT Vulnerability Summary for the Week of November 4, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available.
Vulnerability Summary for the Week of November 4, 2024
High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info 1000 Projects--Beauty Parlour Management System A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. This issue affects some unknown processing of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-10 7.3 CVE-2024-11055 1000 Projects--Bookstore Management System A vulnerability was found in 1000 Projects Bookstore Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /contact_process.php. The manipulation of the argument fnm leads to sql injection. The attack can be launched remotely.
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 28, 2024 to November 3, 2024)
WordPress Plugins with Reported Vulnerabilities Last Week All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
NA - CVE-2024-51661 - Improper Neutralization of Special Elements...
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media Library Assistant allows Command Injection.This issue...
CVE-2024-51661 | David Lingren Media Library Assistant Plugin up to 3.19 on WordPress os command injection
A vulnerability classified as critical has been found in David Lingren Media Library Assistant Plugin up to 3.19 on WordPress. Affected is an unknown function. The manipulation leads to os command injection. This vulnerability is traded as CVE-2024-51661 . It is possible to launch the attack remotely. There is no exploit available.
See 4 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:High
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI