CVE-2024-41117criticalCWE-20

CVE-2024-41117: falha crítica em opengeos streamlit-geospatial

Remote code execution in streamlit geospatial in pages/10_🌍_Earth_Engine_Datasets.py

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar streamlit-geospatial

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 1.3%
streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the `vis_params` variable on line 115 in `pages/10_🌍_Earth_Engine_Datasets.py` takes user input, which is later used in the `eval()` function on line 126, leading to remote code execution. Commit c4f81d9616d40c60584e36abb15300853a66e489 fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
opengeos · streamlit-geospatial
CVEs relacionadas — opengeos streamlit-geospatial

No mesmo produto, das mais perigosas para as menos.

CVE-2024-41115CRITICALRemote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Ocean Color SMI option paletteEPSS 1.5%CVE-2024-41119CRITICALstreamlit-geospatial remote code execution in pages/8_🏜️_Raster_Data_Visualization.pyEPSS 1.4%CVE-2024-41114CRITICALRemote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Gap filled Land Surface Temperature Daily optionEPSS 1.4%CVE-2024-41113CRITICALRemote code execution in streamlit geospatial in pages/1_📷_Timelapse.py Any Earth Engine ImageCollection option vis_paramsEPSS 1.4%CVE-2024-41112CRITICALRemote code execution in streamlit geospatial in pages/1_📷_Timelapse.py Any Earth Engine ImageCollection option paletteEPSS 1.4%CVE-2024-41116CRITICALRemote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Ocean Color SMI option vis_paramsEPSS 1.3%