PT-2024-37932 · Journyx · Journyx

Jaggar Henry · Published 2024-08-07 · Updated 2024-08-12 · CVE-2024-6891

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow. This issue allows for the injection of malicious python code, potentially leading to unauthorized access or control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

CVE-2024-6891

Affected Products

Journyx

References · 7

• 🔥 https://korelogic.com/Resources/Advisories/KL-001-2024-008.txt · Exploit
• https://osv.dev/vulnerability/CVE-2024-6891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6891 · Security Note
• https://twitter.com/cracbot/status/1823238095158010006 · Twitter Post
• https://t.me/cvenotify/89913 · Telegram Post
• http://seclists.org/fulldisclosure/2024/Aug/6 · Note
• https://t.me/cvedetector/2740 · Telegram Post