{"id":"CVE-2024-2243","aliases":["EUVD-2024-27199","GHSA-cjj3-f3rf-jf7w"],"status":"published","title":"Csmock: command injection vulnerability in csmock-plugin-snyk","description":"A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01053,"percentile":0.64642,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2024-04-10T10:14:47Z","modified":"2026-10-28T02:31:10Z","products":[{"vendor":"csutils","product":"csmock"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-2243","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2267336","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TIBNRL3LTG747DNWTBCPRSNRPKOBANMX/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5MJC7U2ZKXUZWELQUJSN56WL5IM4MDR/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X3HF6YTEGGW3SWB4V7JUVIRCXIBRHR7A/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2243","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5MJC7U2ZKXUZWELQUJSN56WL5IM4MDR"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TIBNRL3LTG747DNWTBCPRSNRPKOBANMX"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X3HF6YTEGGW3SWB4V7JUVIRCXIBRHR7A"},{"url":"https://github.com/advisories/GHSA-cjj3-f3rf-jf7w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2243.json","tags":["advisory"]},{"url":"https://github.com/csutils/csmock","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-2243","title":"Csmock: command injection vulnerability in csmock-plugin-snyk","description":"A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers.","status":"published","published":"2024-04-10T10:14:47.671Z","modified":"2025-11-04T22:05:38.828Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:09.540667Z"}],"euvd":[{"id":"EUVD-2024-27199","description":"A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers.","status":"published","published":"2024-04-10T10:14:47Z","modified":"2025-11-04T22:05:38Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"ghsa":[{"id":"GHSA-cjj3-f3rf-jf7w","title":"A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid...","description":"A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers.","status":"published","published":"2024-04-10T15:30:40Z","modified":"2025-11-05T00:31:17Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:38.82847Z"}],"nvd":[{"id":"CVE-2024-2243","description":"A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers.","status":"published","published":"2024-04-10T11:15:49.443Z","modified":"2026-06-17T07:24:06.957Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:09:49.255123Z"}],"osv":[{"id":"CVE-2024-2243","title":"Csmock: command injection vulnerability in csmock-plugin-snyk","description":"A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers.","status":"published","published":"2024-04-10T10:14:47.671Z","modified":"2026-10-28T02:31:10.104849286Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:38.577405Z"}]}}