Back

CVE-2024-27320

Sept. 12, 2024, 6:14 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Refuel Autolabel library

  • 0.0.8
  • newer

Source

6f8de1f0-f67e-45a6-b68f-98777fdb759c

Tags

6f8de1f0-f67e-45a6-b68f-98777fdb759c
CWE-95
2024-09-12
CVE-2024-27320

CVE-2024-27320 details

Published : Sept. 12, 2024, 1:15 p.m.
Last Modified : Sept. 12, 2024, 6:14 p.m.

Description

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code will be passed to an eval function which executes it.

CVSS Score

1 2 3 4 5 6 7.8 8 9 10

Weakness

Weakness Name Description
CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

CVSS Data

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

7.8

Exploitability Score

1.8

Impact Score

5.9

Base Severity

HIGH

Vector String : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL Source
https://hiddenlayer.com/sai-security-advisory/2024-09-autolabel/ 6f8de1f0-f67e-45a6-b68f-98777fdb759c
This website uses the NVD API, but is not approved or certified by it.