CVE-2024-24899
Command injection in aops-zeus
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.
This issue affects aops-zeus: from 1.2.0 through 1.4.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Command injection in aops-zeus
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.
This issue affects aops-zeus: from 1.2.0 through 1.4.0.
- Record
CVE-2024-24899- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2024-22262
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.
This issue affects aops-zeus: from 1.2.0 through 1.4.0.
- Record
EUVD-2024-22262- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5gv4-m6hr-96m6
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.
This issue affects aops-zeus: from 1.2.0 through 1.4.0.
- Record
GHSA-5gv4-m6hr-96m6- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.
This issue affects aops-zeus: from 1.2.0 through 1.4.0.
- Record
CVE-2024-24899- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVOESA-2024-1291
aops-zeus security update
A host and user manager service which is the foundation of aops.
Security Fix(es):
In aops-zeus software versions 1.2.0~1.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be executed on the remote host, which may cause the remote host system to crash, suffering serious consequences of security threats and losses.(CVE-2024-24899)
- Record
OESA-2024-1291- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1292
aops-zeus security update
A host and user manager service which is the foundation of aops.
Security Fix(es):
In aops-zeus software versions 1.2.0~1.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be executed on the remote host, which may cause the remote host system to crash, suffering serious consequences of security threats and losses.(CVE-2024-24899)
- Record
OESA-2024-1292- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1293
aops-zeus security update
A host and user manager service which is the foundation of aops.
Security Fix(es):
In aops-zeus software versions 1.2.0~1.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be executed on the remote host, which may cause the remote host system to crash, suffering serious consequences of security threats and losses.(CVE-2024-24899)
- Record
OESA-2024-1293- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1294
aops-zeus security update
A host and user manager service which is the foundation of aops.
Security Fix(es):
In aops-zeus software versions 1.2.0~1.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be executed on the remote host, which may cause the remote host system to crash, suffering serious consequences of security threats and losses.(CVE-2024-24899)
- Record
OESA-2024-1294- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aops-zeusopenEuler:22.03-LTS-SP3 |
before v1.4.0-7.oe2203sp3 | v1.4.0-7.oe2203sp3 |
aops-zeusopenEuler:20.03-LTS-SP4 |
before v1.3.1-6.oe2003sp4 | v1.3.1-6.oe2003sp4 |
aops-zeusopenEuler:22.03-LTS-SP1 |
before v1.2.0-5.oe2203sp1 | v1.2.0-5.oe2203sp1 |
aops-zeusopenEuler:22.03-LTS-SP2 |
before v1.2.1-3.oe2203sp2 | v1.2.1-3.oe2203sp2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-24899 is a high vulnerability (CVSS 7.2) in Openeuler Aops-zeus, published March 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in aops-zeus v1.4.0-7.oe2203sp3.
References
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-1292
gitee.com/src-openeuler/aops-zeus/pulls/108
Show 6 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-24899
github.com/advisories/GHSA-5gv4-m6hr-96m6