CVE-2024-32651

Katalog CVE

CVSS 10.0 · Critical EPSS 83,6%

Kerentanan Improper Neutralization of Special Elements Used in a Template Engine. Skor CVSS 3.1 10.0 (Critical) menurut github.com.

Deskripsi (NVD)

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).

Rincian

Terbit di NVD

26 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

10.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

83,6% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://blog.hacktivesecurity.com/index.php/2024/05/08/cve-2024-32651-server-side-template-injection-changedet...
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.45.21
• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4r7v-whpg-8rx3
• https://www.onsecurity.io/blog/server-side-template-injection-with-jinja2