CVE-2024-22836

critical · 9.8

An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.

9.8

CVSS

30.0%

EPSS (exploit prob.)

98th

EPSS percentile

2024-02-08

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
akaunting	akaunting	< 3.1.4

Check a specific version with /api/v1/cve/match.

References

https://akaunting.com/
https://github.com/akaunting/akaunting/releases/tag/3.1.4
https://github.com/u32i/cve/tree/main/CVE-2024-22836
https://akaunting.com/
https://github.com/akaunting/akaunting/releases/tag/3.1.4
https://github.com/u32i/cve/tree/main/CVE-2024-22836

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-22836