What is CVE-2024-3955?

CVE-2024-3955 is a critical-severity vulnerability in Craftbeerpi - Brewing Controller 4, classified under Code Injection. CVSS score: 9.8/10. Published 2024-05-02.

How severe is CVE-2024-3955?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Craftbeerpi - Brewing Controller 4

CVE-2024-3955

URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system_controller.py" without prior validation allowing to execute arbitrary code.This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.011 (63.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Craftbeerpi - Brewing Controller 4 — versions 4.0.0.58 (commit 563fae9)
Pibrewing Craftbeerpi 4 — versions 4.0.0.58 (commit 563fae9)

Weakness classification (CWE)

CWE-94 — Code Injection

References

cvd@cert.pl (third-party-advisory)
cvd@cert.pl (third-party-advisory)
cvd@cert.pl (issue-tracking)

Frequently asked questions

What is CVE-2024-3955?: CVE-2024-3955 is a critical-severity vulnerability in Craftbeerpi - Brewing Controller 4, classified under Code Injection. CVSS score: 9.8/10. Published 2024-05-02.
How severe is CVE-2024-3955?: Critical severity. CVSS v3 base score is 9.8 out of 10.