CVE-2024-40641
Last modified
CVE-2024-40641 is a high-severity vulnerability rated 7.4/10 on the CVSS scale. Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code option and signature has been discovered. EPSS estimates a 0.31% chance of exploitation in the next 30 days.
Description
Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code template without -code option and signature has been discovered. Some web applications inherit from Nuclei and allow users to edit and execute workflow files. In this case, users can execute arbitrary commands. (Although, as far as I know, most web applications use -t to execute). This issue has been addressed in version 3.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Metrics
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-40641?
How severe is CVE-2024-40641?
How do I fix CVE-2024-40641?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-40636Steeltoe is an open source project that provides a collectio…5.3
- CVE-2024-40637dbt enables data analysts and engineers to transform their d…7.8
- CVE-2024-40638GLPI is a free asset and IT management software package. An …8.8
- CVE-2024-40639Rejected reason: This CVE is a duplicate of another CVE.
- CVE-2024-4064A vulnerability was found in Tenda AC8 16.03.34.09. It has b…8.8
- CVE-2024-40640vodozemac is an open source implementation of Olm and Megolm…2.9
- CVE-2024-40642The netty incubator codec.bhttp is a java language binary ht…8.1
- CVE-2024-40643Joplin is a free, open source note taking and to-do applicat…9.6
- CVE-2024-40644gitoxide An idiomatic, lean, fast & safe pure Rust implement…6.8
- CVE-2024-40645FOG is a cloning/imaging/rescue suite/inventory management s…8.8
- CVE-2024-40646Vertex is a management tool for PT (Private Tracker) users t…8.6
- CVE-2024-40647sentry-sdk is the official Python SDK for Sentry.io. A bug i…5.3
Are you affected by CVE-2024-40641?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST