Command injection vulnerability in programing languages on Microsoft Windows operating system.
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-3566US | critical9.8 | — | ||
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific condit… | ||||
02
references
External citations — patches, advisories, analysis.
- https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/WEB
- https://kb.cert.org/vuls/id/123335WEB
- https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-wayWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-3566WEB
- https://www.cve.org/CVERecord?id=CVE-2024-1874WEB
- https://www.cve.org/CVERecord?id=CVE-2024-22423WEB
- https://www.cve.org/CVERecord?id=CVE-2024-24576WEB
- https://www.kb.cert.org/vuls/id/123335WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan