← Back

CVE-2024-3566

nvd nist
Published: Apr 10, 2024Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Affected (9)

Products: Haskell: Process Library · Nodejs: Node.js · Php: Php · +2 more
Show all products
Haskell: Process Library · Nodejs: Node.js · Php: Php · Rust Lang: Rust · Yt Dlp Project: Yt Dlp
Haskell
1 product
Process Library
Nodejs
1 product
Node.js
Php
1 product
Php
Rust Lang
1 product
Rust
Yt Dlp Project
1 product
Yt Dlp
Configuration A
9 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Process Library
Before 1.6.19.0
Nodejs
Node.js
Before 18.20.2
Node.js
From 19.0.0 to 20.12.2
Node.js
From 21.0.0 to 21.7.3
Php
Php
Before 8.1.28
Php
From 8.2.0 to 8.2.18
Php
From 8.3.0 to 8.3.6
Rust
Before 1.77.2
Yt Dlp
From 2021.04.11 to 2024.04.09
Running on/withPlatform Versions
Microsoft
Windows
All versions

Related CWEs

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (15)

Source: cret@cert.org
ExploitThird Party Advisory
Source: cret@cert.org
Third Party Advisory
Source: cret@cert.org
Technical Description
Source: cret@cert.org
Not Applicable
Source: cret@cert.org
Not Applicable
Source: cret@cert.org
Not Applicable
Source: cret@cert.org
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Technical Description
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable

Timeline

No history available yet.