VDB
CVE-2024-48963
CVE-2024-48963
PUBLISHED
CVSS 7.5 HIGH
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects.
EPSS 0.44% · 36.7th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
0.44%
36.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Snyk | Snyk PHP Plugin | 0, 0 |
| npm | snyk-php-plugin | 0, 0 |
| Snyk | Snyk Cli | 0, 0 |
| snyk | snyk_php_plugin | 0, 0 |
| snyk | snyk_cli | 0, 0 |
| snyk | snyk_cli | 0, 0 |
Timeline
- Oct 23, 2024 CVE Published
- Oct 23, 2024 Coalition ESS Score
- Oct 23, 2024 PoC Published
- Oct 24, 2024 EPSS Score
- Oct 25, 2024 Coalition ESS Score
- Oct 30, 2024 Coalition ESS Score
- Nov 11, 2024 EPSS Score
- Nov 30, 2024 EPSS Score
- Dec 19, 2024 EPSS Score
- Jan 7, 2025 EPSS Score
- Jan 25, 2025 EPSS Score
- Feb 13, 2025 EPSS Score