Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-27920

Good to know:

icon

Date: March 15, 2024

projectdiscovery/nuclei is a fast and customisable vulnerability scanner based on simple YAML based DSL. A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This advisory outlines the impacted users, provides details on the security patch, and suggests mitigation strategies. The vulnerability is addressed in Nuclei v3.2.0. Users are strongly recommended to update to this version to mitigate the security risk. Users should refrain from using custom workflows if unable to upgrade immediately. Only trusted, verified workflows should be executed.

Language: Go

Severity Score

Related Resources (7)

https://github.com/projectdiscovery/nuclei/pull/4822
https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-w5wx-6g2r-r78q
https://docs.projectdiscovery.io/templates/protocols/code
https://docs.projectdiscovery.io/templates/reference/template-signing
https://nvd.nist.gov/vuln/detail/CVE-2024-27920
https://docs.projectdiscovery.io/templates/workflows/overview
https://www.mend.io/vulnerability-database/CVE-2024-27920

Severity Score

Weakness Type (CWE)

OS Command Injections

CWE-78

Top Fix

icon

Upgrade Version

Upgrade to version v3.2.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us