CVE-2024-13129

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-13129
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13129.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-13129
Published
2025-01-03T21:31:06.704Z
Modified
2026-08-08T03:30:41.727071377Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Roxy-WI roxy.py action_service os command injection
Details

A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.1.4 is able to address this issue. The identifier of the patch is 32313928eb9ce906887b8a30bf7b9a3d5c0de1be. It is recommended to upgrade the affected component.

Database specific 
{
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13129.json"
}
References

Affected packages

Git / github.com/roxy-wi/roxy-wi

Affected ranges

Type
GIT
Repo
https://github.com/roxy-wi/roxy-wi
Events
Introduced
98fb3fb288a32aae262b19c383002bd1c2b33b60
Fixed
c8b1822e8ae63d577cb529bfb12fd4057b69d1d5
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "8.1.0"
        },
        {
            "last_affected": "8.1.0"
        },
        {
            "introduced": "8.1.1"
        },
        {
            "last_affected": "8.1.1"
        },
        {
            "introduced": "8.1.2"
        },
        {
            "last_affected": "8.1.2"
        },
        {
            "introduced": "8.1.3"
        },
        {
            "last_affected": "8.1.3"
        }
    ]
}

Affected versions

8.*
8.1.0
8.1.1
8.1.2
8.1.3
v8.*
v8.1.0.1
v8.1.1
v8.1.2
v8.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13129.json"