An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.
References
| Link | Resource |
|---|---|
| https://akaunting.com/ | Product |
| https://github.com/akaunting/akaunting/releases/tag/3.1.4 | Release Notes |
| https://github.com/u32i/cve/tree/main/CVE-2024-22836 | Third Party Advisory |
| https://akaunting.com/ | Product |
| https://github.com/akaunting/akaunting/releases/tag/3.1.4 | Release Notes |
| https://github.com/u32i/cve/tree/main/CVE-2024-22836 | Third Party Advisory |
Configurations
History
21 Nov 2024, 08:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://akaunting.com/ - Product | |
| References | () https://github.com/akaunting/akaunting/releases/tag/3.1.4 - Release Notes | |
| References | () https://github.com/u32i/cve/tree/main/CVE-2024-22836 - Third Party Advisory |
15 Feb 2024, 16:00
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Akaunting akaunting
Akaunting |
|
| CPE | cpe:2.3:a:akaunting:akaunting:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-78 | |
| References | () https://github.com/akaunting/akaunting/releases/tag/3.1.4 - Release Notes | |
| References | () https://akaunting.com/ - Product | |
| References | () https://github.com/u32i/cve/tree/main/CVE-2024-22836 - Third Party Advisory |
08 Feb 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-08 20:15
Updated : 2024-11-21 08:56
NVD link : CVE-2024-22836
Mitre link : CVE-2024-22836
CVE.ORG link : CVE-2024-22836
JSON object : View
Products Affected
akaunting
- akaunting
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')