{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36360", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-05-24T02:04:55.207Z", "datePublished": "2024-06-11T04:19:39.122Z", "dateUpdated": "2025-03-14T14:43:00.422Z"}, "containers": {"cna": {"affected": [{"vendor": "Keisuke Nakayama", "product": "awkblog", "versions": [{"version": "v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product."}], "problemTypes": [{"descriptions": [{"description": "OS command injection", "lang": "en", "type": "text"}]}], "references": [{"url": "https://github.com/yammerjp/awkblog/issues/1"}, {"url": "https://jvn.jp/en/jp/JVN80506242/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-06-11T04:19:39.122Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "affected": [{"vendor": "keisuke_nakayama", "product": "awkblog", "cpes": ["cpe:2.3:a:keisuke_nakayama:awkblog:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-11T15:44:36.276647Z", "id": "CVE-2024-36360", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T14:43:00.422Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:04.935Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/yammerjp/awkblog/issues/1", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN80506242/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/yammerjp/awkblog/issues/1", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN80506242/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:37:04.935Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36360", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-11T15:44:36.276647Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:keisuke_nakayama:awkblog:*:*:*:*:*:*:*:*"], "vendor": "keisuke_nakayama", "product": "awkblog", "versions": [{"status": "affected", "version": "v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-11T15:48:00.998Z"}}], "cna": {"affected": [{"vendor": "Keisuke Nakayama", "product": "awkblog", "versions": [{"status": "affected", "version": "v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier"}]}], "references": [{"url": "https://github.com/yammerjp/awkblog/issues/1"}, {"url": "https://jvn.jp/en/jp/JVN80506242/"}], "descriptions": [{"lang": "en", "value": "OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "OS command injection"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-06-11T04:19:39.122Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36360", "state": "PUBLISHED", "dateUpdated": "2025-03-14T14:43:00.422Z", "dateReserved": "2024-05-24T02:04:55.207Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-06-11T04:19:39.122Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. If a remote unauthenticated attacker sends a specially crafted HTTP request, an arbitrary OS command may be executed with the privileges of the affected product on the machine running the product."}, {"lang": "es", "value": "La vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo existe en awkblog v0.0.1 (hash de commit: 7b761b192d0e0dc3eef0f30630e00ece01c8d552) y versiones anteriores. Si un atacante remoto no autenticado env\u00eda una solicitud HTTP especialmente manipulada, se puede ejecutar un comando arbitrario del sistema operativo con los privilegios del producto afectado en la m\u00e1quina que ejecuta el producto."}], "id": "CVE-2024-36360", "lastModified": "2025-03-14T15:15:41.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-06-11T05:15:53.610", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://github.com/yammerjp/awkblog/issues/1"}, {"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN80506242/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/yammerjp/awkblog/issues/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://jvn.jp/en/jp/JVN80506242/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}