CVE-2024-10224

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-10224
Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by open()ing a "pesky pipe" (such as passing "commands|" as a filename) or by passing arbitrary strings to eval().

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529 Exploit Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2024-10224 Third Party Advisory
https://www.qualys.com/2024/11/19/needrestart/needrestart.txt Exploit Mitigation
https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html Mailing List
https://www.openwall.com/lists/oss-security/2024/11/19/1 Exploit Mailing List Mitigation
Configurations

Configuration 1 (hide)

cpe:2.3:a:rschupp:modules\:\:scandeps:*:*:*:*:*:perl:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

26 Aug 2025, 17:36

Type Values Removed Values Added
References () https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529 - () https://github.com/rschupp/Module-ScanDeps/security/advisories/GHSA-g597-359q-v529 - Exploit, Vendor Advisory
References () https://www.cve.org/CVERecord?id=CVE-2024-10224 - () https://www.cve.org/CVERecord?id=CVE-2024-10224 - Third Party Advisory
References () https://www.qualys.com/2024/11/19/needrestart/needrestart.txt - () https://www.qualys.com/2024/11/19/needrestart/needrestart.txt - Exploit, Mitigation
References () https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html - () https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html - Mailing List
References () https://www.openwall.com/lists/oss-security/2024/11/19/1 - () https://www.openwall.com/lists/oss-security/2024/11/19/1 - Exploit, Mailing List, Mitigation
First Time Rschupp
Debian
Debian debian Linux
Rschupp modules\
CPE cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:rschupp:modules\:\:scandeps:*:*:*:*:*:perl:*:*

03 Dec 2024, 14:15

Type Values Removed Values Added
References
  • () https://www.openwall.com/lists/oss-security/2024/11/19/1 -

21 Nov 2024, 08:48

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/11/msg00015.html -
Summary
  • (es) Qualys descubrió que si se usaba una entrada no desinfectada con la librería Modules::ScanDeps, antes de la versión 1.36, un atacante local podría posiblemente ejecutar comandos de shell arbitrarios abriendo una "molesta tubería" (como pasar "commands|" como nombre de archivo) o pasando cadenas arbitrarias a eval().

19 Nov 2024, 20:35

Type Values Removed Values Added
CWE CWE-78

19 Nov 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-19 18:15

Updated : 2025-08-26 17:36

NVD link : CVE-2024-10224

Mitre link : CVE-2024-10224

CVE.ORG link : CVE-2024-10224

JSON object : View

Products Affected

rschupp

  • modules\

debian

  • debian_linux
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')