« Volver al listado

CVE-2024-38358

Estado: AplazadaBaja (2.9)—

Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both `oflags::creat` and `rights::fd_write`. Programs can also crash the runtime by creating a symlink pointing outside with `path_symlink` and `path_open`ing the link. This issue has been addressed in commit `b9483d022` which has been included in release version 4.3.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Wasmer — WasmerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-38358",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38358",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-28T13:23:16.763480Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.9,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.4
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "wasmerio",
          "product": "wasmer",
          "versions": [
            {
              "status": "affected",
              "version": "< 4.3.2"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:wasmer:wasmer:*:*:*:*:*:rust:*:*"
          ],
          "vendor": "wasmer",
          "product": "wasmer",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.3.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-19T20:15:11.990",
  "references": [
    {
      "url": "https://github.com/wasmerio/wasmer/commit/b9483d022c602b994103f78ecfe46f017f8ac662",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/wasmerio/wasmer/security/advisories/GHSA-55f3-3qvg-8pv5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/wasmerio/wasmer/commit/b9483d022c602b994103f78ecfe46f017f8ac662",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/wasmerio/wasmer/security/advisories/GHSA-55f3-3qvg-8pv5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wasmer is a web assembly (wasm) Runtime supporting WASIX, WASI and Emscripten. If the preopened directory has a symlink pointing outside, WASI programs can traverse the symlink and access host filesystem if the caller sets both `oflags::creat` and `rights::fd_write`. Programs can also crash the runtime by creating a symlink pointing outside with `path_symlink` and `path_open`ing the link. This issue has been addressed in commit `b9483d022` which has been included in release version 4.3.2. Users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "Wasmer es un tiempo de ejecución de ensamblaje web (wasm) que admite WASIX, WASI y Emscripten. Si el directorio preabierto tiene un enlace simbólico que apunta hacia afuera, los programas WASI pueden atravesar el enlace simbólico y acceder al sistema de archivos del host si la persona que llama configura tanto `oflags::creat` como `rights::fd_write`. Los programas también pueden bloquear el tiempo de ejecución al crear un enlace simbólico que apunte hacia afuera con `path_symlink` y `path_open` en el enlace. Este problema se solucionó en el commit `b9483d022` que se incluyó en la versión 4.3.2. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T07:39:59.320",
  "sourceIdentifier": "security-advisories@github.com"
}