CVE-2024-52959
iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')
- State
- Published
- Severity
- 9.3 Critical
- Published
- Nov 27, 2024
- Updated
- Nov 27, 2024
- Reserved
- Nov 18, 2024
Description
A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H | ZUSO ART |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
iota C.ai Conversational PlatformGalaxy Software Services Corporation |
|
References
- https://zuso.ai/advisory/za-2024-12third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.