CVE-2024-4748 describes a shell command injection vulnerability in the CRUDDIY project (j11g cruddiy). An attacker can exploit this by sending a specially crafted POST request to a locally running CRUDDIY server. This vulnerability carries a CVSS score of 7.8 (HIGH), indicating a significant risk with high impact on confidentiality, integrity, and availability, though it requires user interaction (UI:R) and local access (AV:L). While not actively exploited or having public exploit code, the risk stems from a user potentially visiting a malicious website that triggers the attack against their local CRUDDIY instance. Community discussion and media coverage for this CVE are currently minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 202312.1CPE matchmatch criteria | cpe:2.3:a:j11g:cruddiy:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.