CVE-2024-12358

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-12358

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12358.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-12358

Published

2024-12-09T04:31:11.396Z

Modified

2026-08-12T03:51:45.367023816Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

WeiYe-Jing datax-web add os command injection

Details

A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/job/add/. The manipulation of the argument glueSource leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Database specific

{
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12358.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.1.1"
                },
                {
                    "last_affected": "2.1.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/weiye-jing/datax-web

Affected ranges

Type

GIT

Repo

https://github.com/weiye-jing/datax-web

Events

Introduced

df9ec4dc636bde5442f1a9362d87021bba04c302

Last affected

df9ec4dc636bde5442f1a9362d87021bba04c302

Database specific

Show details

{
    "cpe": "cpe:2.3:a:datax-web_project:datax-web:2.1.1:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "2.1.1"
        },
        {
            "last_affected": "2.1.1"
        }
    ]
}

Affected versions

2.*

2.1.1

v-2.*

v-2.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12358.json"