Vulnerability Description
CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/CycloneDX/cdxgen/issues/1328
- https://github.com/CycloneDX/cdxgen/releases
- https://owasp.org/www-project-dep-scan/
FAQ
What is CVE-2024-50611?
CVE-2024-50611 is a vulnerability with a CVSS score of 7.2 (HIGH). CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is u...
How severe is CVE-2024-50611?
CVE-2024-50611 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-50611?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.