« Volver al listado

CVE-2024-41961

Estado: AplazadaCrítica (9.6)—

Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which later flows into an `eval` sink which executes the code. Fixed in commit 8bce00be93b95a6512ff68fe86bf9554e486bc02.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Elektra — ElektraAIRubyonrails — RailsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-41961",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-41961",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-07T14:22:09.735872Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "sapcc",
          "product": "elektra",
          "versions": [
            {
              "status": "affected",
              "version": "< 8bce00be93b95a6512ff68fe86bf9554e486bc02"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:sapcc:elektra:*:*:*:*:*:*:*:*"
          ],
          "vendor": "sapcc",
          "product": "elektra",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "8bce00be93b95a6512ff68fe86bf9554e486bc02",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-01T15:15:14.310",
  "references": [
    {
      "url": "https://github.com/sapcc/elektra/commit/49aea3b365082681558bf3bf7bf4a51766cfc44d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/sapcc/elektra/commit/8bce00be93b95a6512ff68fe86bf9554e486bc02",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/sapcc/elektra/security/advisories/GHSA-6j2h-486h-487q",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which later flows into an `eval` sink which executes the code. Fixed in commit 8bce00be93b95a6512ff68fe86bf9554e486bc02."
    },
    {
      "lang": "es",
      "value": " Elektra es un panel de Openstack obstinado para operadores y consumidores de servicios Openstack. Se encontró una vulnerabilidad de inyección de código en la funcionalidad de búsqueda en vivo de la aplicación web Elektra basada en Ruby on Rails. Un usuario autenticado puede crear un término de búsqueda que contenga código Ruby, que luego fluye hacia un receptor \"eval\" que ejecuta el código. Corregido en la confirmación 8bce00be93b95a6512ff68fe86bf9554e486bc02."
    }
  ],
  "lastModified": "2026-06-17T07:48:32.043",
  "sourceIdentifier": "security-advisories@github.com"
}