An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor states "we dispute the report's accuracy ... the configuration does not enable remote code execution.."
References
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 08:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/V3x0r/CVE-2024-23738 - Exploit | |
| References | () https://www.electronjs.org/blog/statement-run-as-node-cves - |
26 Feb 2024, 16:27
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor states "we dispute the report's accuracy ... the configuration does not enable remote code execution.." |
16 Feb 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Feb 2024, 21:09
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:postman:postman:*:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* |
|
| References | () https://github.com/V3x0r/CVE-2024-23738 - Exploit | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Postman postman
Apple Postman Apple macos |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
28 Jan 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-28 01:15
Updated : 2024-11-21 08:58
NVD link : CVE-2024-23738
Mitre link : CVE-2024-23738
CVE.ORG link : CVE-2024-23738
JSON object : View
Products Affected
apple
- macos
postman
- postman
CWE