PT-2024-36795 · Unknown · Onyxia-Api

Nicolst · Published 2024-12-20 · Updated 2024-12-20 · CVE-2024-56333

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Onyxia-API versions prior to 2.8.2 Onyxia-API versions prior to 3.1.1 Onyxia-API versions prior to 4.2.0

Description This issue allows authenticated users to remotely execute code within the Onyxia-API, potentially leading to unauthorized access to other user environments and denial of service attacks.

Recommendations For versions prior to 2.8.2, upgrade to version 2.8.2 or later. For versions prior to 3.1.1, upgrade to version 3.1.1 or later. For versions prior to 4.2.0, upgrade to version 4.2.0 or later.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-56333

GHSA-QMCW-H4F9-J3H3

Affected Products

Onyxia-Api

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56333.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-56333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56333 · Security Note
• https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-qmcw-h4f9-j3h3 · Note
• https://twitter.com/CveFindCom/status/1870197816171073777 · Twitter Post
• https://t.me/cvedetector/13456 · Telegram Post
• https://docs.onyxia.sh/vulnerability-disclosure/known-vulnerabilities/vulnerability-20241219 · Note
• https://twitter.com/VulmonFeeds/status/1870206017553805653 · Twitter Post
• https://twitter.com/CVEnew/status/1870201316028625253 · Twitter Post