2 lines
7.5 KiB
JSON
2 lines
7.5 KiB
JSON
{"affected":[{"affectedData":[{"platforms":["Windows"],"product":"Node.js","vendor":"Node.js","versions":[{"lessThanOrEqual":"21.7.2","status":"affected","version":"*","versionType":"custom"}]},{"platforms":["Windows"],"product":"GoLang","vendor":"Go Programming Language","versions":[{"status":"affected","version":"*"}]},{"platforms":["Windows"],"product":"Haskel","vendor":"Haskell Programming Language","versions":[{"status":"affected","version":"*"}]}],"source":"cret@cert.org"},{"affectedData":[{"cpes":["cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"nodejs","vendor":"nodejs","versions":[{"lessThanOrEqual":"21.7.2","status":"affected","version":"0","versionType":"custom"}]},{"cpes":["cpe:2.3:a:haskell:process_library:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"process_library","vendor":"haskell","versions":[{"lessThan":"1.6.19.0","status":"affected","version":"0","versionType":"custom"}]},{"cpes":["cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"rust","vendor":"rust-lang","versions":[{"lessThan":"1.77.2","status":"affected","version":"0","versionType":"custom"}]},{"cpes":["cpe:2.3:a:thephpgroup:thephpgroup:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"thephpgroup","vendor":"thephpgroup","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"cpes":["cpe:2.3:a:yt-dlp_project:yt-dlp:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"yt-dlp","vendor":"yt-dlp_project","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:haskell:process_library:*:*:*:*:*:*:*:*","matchCriteriaId":"838E7C22-2203-42B8-B8DE-52306C0053CD","versionEndExcluding":"1.6.19.0","vulnerable":true},{"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","matchCriteriaId":"22F26905-4C5D-431E-955A-F2A35FA25401","versionEndExcluding":"18.20.2","vulnerable":true},{"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","matchCriteriaId":"F5CD069C-89BE-43CD-B741-0B976DCC5D2A","versionEndExcluding":"20.12.2","versionStartIncluding":"19.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","matchCriteriaId":"43547541-B480-439B-B18C-8FE493599E6F","versionEndExcluding":"21.7.3","versionStartIncluding":"21.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","matchCriteriaId":"FF638A38-6375-40D9-95A8-1013E3B630F9","versionEndExcluding":"8.1.28","vulnerable":true},{"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","matchCriteriaId":"6AC1B000-D5C4-49E9-8EFE-8C5C8FF50AF2","versionEndExcluding":"8.2.18","versionStartIncluding":"8.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","matchCriteriaId":"E88C969D-88C3-46A2-96AB-A3F63E814F24","versionEndExcluding":"8.3.6","versionStartIncluding":"8.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*","matchCriteriaId":"C49FDBA9-6417-4761-9CF1-1EF8E70B782C","versionEndExcluding":"1.77.2","vulnerable":true},{"criteria":"cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*","matchCriteriaId":"2C6B8E2D-693F-494C-BE61-CF52780035AF","versionEndExcluding":"2024.04.09","versionStartIncluding":"2021.04.11","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied."},{"lang":"es","value":"Una vulnerabilidad de inyección de comandos permite a un atacante realizar inyección de comandos en aplicaciones de Windows que dependen indirectamente de la función CreateProcess cuando se cumplen las condiciones específicas."}],"id":"CVE-2024-3566","lastModified":"2026-06-17T07:44:31.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-3566","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-04-15T16:13:02.290928Z","version":"2.0.3"}}]},"published":"2024-04-10T16:15:16.083","references":[{"source":"cret@cert.org","tags":["Exploit","Third Party Advisory"],"url":"https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"},{"source":"cret@cert.org","tags":["Third Party Advisory"],"url":"https://kb.cert.org/vuls/id/123335"},{"source":"cret@cert.org","tags":["Technical Description"],"url":"https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"},{"source":"cret@cert.org","tags":["Not Applicable"],"url":"https://www.cve.org/CVERecord?id=CVE-2024-1874"},{"source":"cret@cert.org","tags":["Not Applicable"],"url":"https://www.cve.org/CVERecord?id=CVE-2024-22423"},{"source":"cret@cert.org","tags":["Not Applicable"],"url":"https://www.cve.org/CVERecord?id=CVE-2024-24576"},{"source":"cret@cert.org","tags":["Not Applicable"],"url":"https://www.kb.cert.org/vuls/id/123335"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://kb.cert.org/vuls/id/123335"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Technical Description"],"url":"https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Not Applicable"],"url":"https://www.cve.org/CVERecord?id=CVE-2024-1874"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Not Applicable"],"url":"https://www.cve.org/CVERecord?id=CVE-2024-22423"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Not Applicable"],"url":"https://www.cve.org/CVERecord?id=CVE-2024-24576"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Not Applicable"],"url":"https://www.kb.cert.org/vuls/id/123335"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"nvd@nist.gov","type":"Primary"}]}
|