Vulnerability · Published Oct 17, 2024 · Assigned by facebook
CVE-2024-49400
Critical 9.8
In plain English
A critical-severity security flaw in Tacquito from Meta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 60.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. That would have potentially allowed unauthorized commands to be executed.
Affected products (as reported)
References
- https://www.facebook.com/security/advisories/cve-2024-49400 x_refsource_CONFIRM