PT-2024-21963 · Alldata · Alldata

Raybye · Published 2024-04-02 · Updated 2025-03-27 · CVE-2024-27604

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alldata version 0.4.6

Description The issue allows for command execution, where system commands can be deserialized.

Recommendations For Alldata version 0.4.6, as a temporary workaround, consider restricting the deserialization of system commands until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-27604

Affected Products

Alldata

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-27604 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27604 · Vendor Advisory
• https://gist.github.com/Raybye/b88847e9e9a94a1b1028dbdb7e38c12b · Note
• https://t.me/cvenotify/75558 · Telegram Post
• https://t.me/cvenotify/116640 · Telegram Post
• https://twitter.com/CVEnew/status/1775270723369734323 · Twitter Post
• https://t.me/cvenotify/75637 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1775292358440935655 · Twitter Post