CVEvulnerability
CVE-2024-22836
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2024-02-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78
Description
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.
Affected configurations
• akaunting akaunting (< 3.1.4)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://akaunting.com/ Product
- https://github.com/akaunting/akaunting/releases/tag/3.1.4 Release Notes
- https://github.com/u32i/cve/tree/main/CVE-2024-22836 Third Party Advisory
- https://akaunting.com/ Product
- https://github.com/akaunting/akaunting/releases/tag/3.1.4 Release Notes
- https://github.com/u32i/cve/tree/main/CVE-2024-22836 Third Party Advisory