CVE-2024-1748

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-1748

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1748.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-1748

Published

2024-02-22T19:31:04.494Z

Modified

2026-07-15T01:48:55.196848044Z

Severity

5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator

Summary

van_der_Schaar LAB AutoPrognosis Release Note load_model_from_file deserialization

Details

A vulnerability classified as critical was found in vanderSchaar LAB AutoPrognosis 0.1.21. This vulnerability affects the function loadmodelfrom_file of the component Release Note Handler. The manipulation leads to deserialization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-254530 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cwe_ids": [
        "CWE-502"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1748.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "0.1.21"
                },
                {
                    "last_affected": "0.1.21"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/vanderschaarlab/autoprognosis

Affected ranges

Type

GIT

Repo

https://github.com/vanderschaarlab/autoprognosis

Events

Introduced

e81ed212c1e54ad49a79f756151df5deacfa3296

Last affected

e81ed212c1e54ad49a79f756151df5deacfa3296

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:vanderschaar-lab:autoprognosis:0.1.21:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.1.21"
        },
        {
            "last_affected": "0.1.21"
        }
    ]
}

Affected versions

0.*

0.1.21

v0.*

v0.1.21

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-1748.json"