CVE-2024-7679
Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
Published: Sep 25, 2024 / Updated: 55d ago

010

CVSS 7.8EPSS 0.04%High

CVE info copied to clipboard

Summary

In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.

Impact

This vulnerability allows for a command injection attack, which can lead to high impacts on confidentiality, integrity, and availability of the affected system. An attacker could potentially execute arbitrary commands on the target system, leading to unauthorized access, data manipulation, or system disruption. The attack requires local access and user interaction, but no privileges are needed to exploit it.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability has been addressed in Telerik UI for WinForms version 2024 Q3 (2024.3.924) and later.

Mitigation

1. Update Telerik UI for WinForms to version 2024.3.924 or later. 2. If immediate update is not possible, implement strict input validation and sanitization for hyperlink elements. 3. Apply the principle of least privilege to limit the potential impact of successful exploits. 4. Monitor systems for suspicious activities related to command injection attempts. 5. Educate users about the risks of interacting with untrusted hyperlinks or content within the application.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-7679

Sep 25, 2024 at 2:15 PM

CVSS

A CVSS base score of 7.8 has been assigned.

Sep 25, 2024 at 2:20 PM / nvd

First Article

Feedly found the first article mentioning CVE-2024-7679. See article

Sep 25, 2024 at 2:22 PM / Vulners.com RSS Feed

CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 25, 2024 at 2:22 PM

Threat Intelligence Report

CVE-2024-7679 is one of four recently reported vulnerabilities in the Progress Telerik UI that could lead to command injection and code execution. The criticality and CVSS score of this vulnerability are not specified in the provided information, nor is there any mention of exploitation in the wild, proof-of-concept exploits, mitigations, detections, or patches available. Additionally, there is no information regarding downstream impacts to other third-party vendors or technology. See article

Oct 8, 2024 at 11:16 AM

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (208755)

Oct 11, 2024 at 11:15 PM