{"id":"CVE-2024-11482","aliases":["EUVD-2024-34063","GHSA-whhw-2v2c-qg98"],"status":"published","title":"A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and...","description":"A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02527,"percentile":0.85002,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2024-11-29T07:03:33Z","modified":"2026-06-17T06:57:48Z","products":[{"vendor":"hp","product":"enterprise_security_manager"},{"vendor":"trellix","product":"enterprise_security_manager"},{"vendor":"trellix","product":"trellix enterprise security manager (esm)"}],"references":[{"url":"https://thrive.trellix.com/s/article/000014058#h2_0","tags":["Permissions Required"]},{"url":"https://hackerone.com/reports/2817658","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11482"},{"url":"https://github.com/advisories/GHSA-whhw-2v2c-qg98"}],"sources":{"cve":[{"id":"CVE-2024-11482","description":"A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.","status":"published","published":"2024-11-29T07:03:33.494Z","modified":"2025-03-18T14:56:37.259Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:19.965827Z"}],"euvd":[{"id":"EUVD-2024-34063","description":"A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.","status":"published","published":"2024-11-29T07:03:33Z","modified":"2025-03-18T14:56:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:00.87598Z"}],"ghsa":[{"id":"GHSA-whhw-2v2c-qg98","title":"A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and...","description":"A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.","status":"published","published":"2024-11-29T12:31:48Z","modified":"2025-03-18T15:31:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:00:20.689988Z"}],"nvd":[{"id":"CVE-2024-11482","description":"A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.","status":"published","published":"2024-11-29T08:15:04.437Z","modified":"2026-06-17T06:57:48.997Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:38.973941Z"}]}}