Home > Vulnerability Database > CVE-2024-3566

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2024-3566

Good to know:

Date: April 10, 2024

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Language: HASKELL

Severity Score

9.8

Related Resources (9)

Url: https://www.cve.org/CVERecord?id=CVE-2024-22423

Url: https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/

Url: https://kb.cert.org/vuls/id/123335

Url: https://www.cve.org/CVERecord?id=CVE-2024-24576

Url: https://www.kb.cert.org/vuls/id/123335

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-3566

Url: https://www.cve.org/CVERecord?id=CVE-2024-1874

Url: https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way

Url: https://www.mend.io/vulnerability-database/CVE-2024-3566

Severity Score

9.8

Top Fix

Upgrade Version

Upgrade to version v1.6.19.0

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us