PT-2024-20744 · Canto · Canto

Rodrigo Escobar · CVE-2024-25096 · Published 2024-04-03 · Updated 2025-04-10

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Canto versions 3.0.7 and earlier

Description The issue is related to improper control of generation of code, also known as 'Code Injection'. This allows for code injection in Canto Inc.'s Canto.

Recommendations For versions 3.0.7 and earlier, update to a version later than 3.0.7 to resolve the issue. As a temporary workaround, consider restricting access to any functionality that allows code generation or execution until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-25096

Affected Products

Canto

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-25096 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25096 · Vendor Advisory
• https://twitter.com/CVEnew/status/1775500278566896121 · Twitter Post
• https://patchstack.com/database/vulnerability/canto/wordpress-canto-plugin-3-0-6-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/118620 · Telegram Post