CVE-2024-9145

Local command injection in Wiz Code Visual Studio Code extension

CVSS 7.1 HIGHEPSS 0.8%CWE-77

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.1EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

01 out 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Wiz Code Visual Studio Code extension in versions 1.0.0 up to 1.5.3 and Wiz (legacy) Visual Studio Code extension in versions 0.13.0 up to 0.17.8 are vulnerable to local command injection if the user opens a maliciously crafted Dockerfile located in a path that has been marked as a "trusted folder" within Visual Studio Code, and initiates a manual scan of the file.

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Produtos afetados

Wiz · Wiz Code Visual Studio Code extension

Referências

https://marketplace.visualstudio.com/items/WizCloud.wizcli-vscode/changelog https://marketplace.visualstudio.com/items/WizCloud.wiz-vscode/changelog https://www.wiz.io/security-advisories