CVE search · CVE-2024-3566
CVE-2024-3566
critical 9.8
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
Details
- Status
- Analyzed
- Published
- Last changed
- Source
- cret@cert.org
- Weakness
- CWE-77
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
| CVSS 3.1 | critical 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- haskell · process_library
- nodejs · node.js
- php · php
- rust-lang · rust
- yt-dlp_project · yt-dlp
References
- https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ExploitThird Party Advisory
- https://kb.cert.org/vuls/id/123335Third Party Advisory
- https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-wayTechnical Description
- https://www.cve.org/CVERecord?id=CVE-2024-1874Not Applicable
- https://www.cve.org/CVERecord?id=CVE-2024-22423Not Applicable
- https://www.cve.org/CVERecord?id=CVE-2024-24576Not Applicable
- https://www.kb.cert.org/vuls/id/123335Not Applicable
- https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ExploitThird Party Advisory
- https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566Third Party Advisory
- https://kb.cert.org/vuls/id/123335Third Party Advisory
- https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-wayTechnical Description
- https://www.cve.org/CVERecord?id=CVE-2024-1874Not Applicable
- https://www.cve.org/CVERecord?id=CVE-2024-22423Not Applicable
- https://www.cve.org/CVERecord?id=CVE-2024-24576Not Applicable
- https://www.kb.cert.org/vuls/id/123335Not Applicable