Vulnerability · Published Jan 2, 2024 · Assigned by VulDB

CVE-2024-0195spider-flow FunctionController.java FunctionService.saveFunction code injection

Medium 6.3

In plain English

A medium-severity code injection in spider-flow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 19.3% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)19.3%top 2.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249510 is the identifier assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	spider-flow	0.4.3

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.249510 vdb-entry, technical-description
https://vuldb.com/?ctiid.249510 signature, permissions-required
https://github.com/laoquanshi/puppy/blob/main/spider-flow%20code%20injection%20causes%20rce.md broken-link, exploit