One Article Review
| Source |  CVE Liste |
|---|---|
| Identifiant | 8285958 |
| Date de publication | 2022-11-30 13:15:10 (vue: 2022-11-30 16:07:37) |
| Titre | CVE-2022-24441 |
| Texte | The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: |
| Envoyé | Oui |
| Condensat | **note:** 1064 114426 132308 2022 24441 3037342 40764 <=1 <=2 <=v20221109 <=v20221115 additionally addresses affected affected: all analyzed analyzing application are are: attacker before build can cli code coerce commands convince cve directly downloaded eclipse enabled engineering executed exploitation feature file fixed fixed: folder gradle has https://security ide include independent injection installed intellij invoke io/vuln/snyk issue jar language level likely malicious marked may must one opened order package plugin plugins privileges project reported require running scan server snyk social some studio subsequent successful such target then tool triggered trust untrusted upgrading user version versions visual vulnerability vulnerable well when where which who will would wrapper ‘trusted’ |
| Tags | Tool Vulnerability |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.