Riskcovery

CVE-2024-24897

Remote command execution in A-Tune-Collector

State
Published
Severity
8.1 High
Published
Mar 25, 2024
Updated
Aug 12, 2024
Reserved
Feb 1, 2024

Read the record on cve.org

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py.

This issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HopenEuler

Weaknesses

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

ProductVersions
A-Tune-CollectoropenEuler
  • 1.1.0-3 through 1.3.0Affectedfrom https://gitee.com/src-openeuler/A-Tune-Collector/commit/b457eb50cb7528a16a82812562f7627ec6712cf6Not affectedfrom https://gitee.com/src-openeuler/A-Tune-Collector/commit/588032f3067f01aef49ee2583888370cae015517Not affectedfrom https://gitee.com/src-openeuler/A-Tune-Collector/commit/d6923f8d15ba17b3c517dff289c12480023909eaNot affectedfrom https://gitee.com/src-openeuler/A-Tune-Collector/commit/9b4b6990517d5427a8b48a1beb4dfc233ff91a14Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.