CVE-2024-40641
HIGH EPSS 22.8%
Published Jul 17, 20241y ago · Modified Jun 17, 20262w ago
7.4 CVSS 3.1
Published Jul 17, 2024 1y ago
Last Modified Jun 17, 2026 2w ago
Description
Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code option and signature has been discovered. Some web applications inherit from Nuclei and allow users to edit and execute workflow files. In this case, users can execute arbitrary commands. (Although, as far as I know, most web applications use -t to execute). This issue has been addressed in version 3.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N Attack Vector Local
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality High
Integrity High
Availability None
Threat Intelligence
EPSS Exploit Probability
22.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-78 OS Command Injection Injection
References 1
- github.com https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-c3q9-c27p-cw9h
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.