{"id":"CVE-2024-24897","aliases":["EUVD-2024-22260","GHSA-75vr-rxgp-h26f","OESA-2024-1271","OESA-2024-1272","OESA-2024-1273","OESA-2024-1274"],"status":"published","title":"Remote command execution in A-Tune-Collector","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py.\n\nThis issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01402,"percentile":0.72753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2024-03-15T11:06:43Z","modified":"2026-08-18T01:18:18Z","fixes":[{"ecosystem":"openEuler:22.03-LTS-SP2","package":"A-Tune-Collector","fixed_in":["atune-collector-1.1.0-8.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"A-Tune-Collector","fixed_in":["atune-collector-1.1.0-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"A-Tune-Collector","fixed_in":["atune-collector-1.1.0-8.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"A-Tune-Collector","fixed_in":["atune-collector-1.1.0-8.oe2203sp1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"A-Tune-Collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"atune-collector-1.1.0-8.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"A-Tune-Collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"atune-collector-1.1.0-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"A-Tune-Collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"atune-collector-1.1.0-8.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"A-Tune-Collector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"atune-collector-1.1.0-8.oe2203sp1"}]}]}],"products":[{"vendor":"openeuler","product":"a-tune-collector"}],"references":[{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1273","tags":["x_transferred"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1271","tags":["x_transferred"]},{"url":"https://gitee.com/src-openeuler/A-Tune-Collector/pulls/45","tags":["x_transferred"]},{"url":"https://gitee.com/src-openeuler/A-Tune-Collector/pulls/47","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24897","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-75vr-rxgp-h26f"},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1271","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1272","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1273","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1274","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-24897","title":"Remote command execution in A-Tune-Collector","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py.\n\nThis issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0.\n\n","status":"published","published":"2024-03-25T07:10:48.934Z","modified":"2024-08-12T18:46:09.906Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:13.991836Z"}],"euvd":[{"id":"EUVD-2024-22260","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py.\n\nThis issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0.\n\n","status":"published","published":"2024-03-25T07:10:48Z","modified":"2024-08-12T18:46:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:19.748102Z"}],"ghsa":[{"id":"GHSA-75vr-rxgp-h26f","title":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability...","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py.\n\nThis issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0.\n\n","status":"published","published":"2024-03-25T09:32:33Z","modified":"2024-03-25T09:32:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:55:43.067988Z"}],"nvd":[{"id":"CVE-2024-24897","description":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py.\n\nThis issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0.\n\n","status":"published","published":"2024-03-25T07:15:50.35Z","modified":"2026-06-17T07:15:11.057Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"OESA-2024-1271","title":"A-Tune-Collector security update","description":"A-Tune-Collector is used to collect various system resources.\r\n\r\nSecurity Fix(es):\r\n\r\nWhen the get method in the sched.py file in the A-Tune-Collector software package is used to obtain the process ID, shell command combination and injection risks exist. This flaw could lead to remote arbitrary command execution.(CVE-2024-24897)","status":"published","published":"2024-03-15T11:06:43Z","modified":"2026-08-18T01:18:18.675252413Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1272","title":"A-Tune-Collector security update","description":"A-Tune-Collector is used to collect various system resources.\r\n\r\nSecurity Fix(es):\r\n\r\nWhen the get method in the sched.py file in the A-Tune-Collector software package is used to obtain the process ID, shell command combination and injection risks exist. This flaw could lead to remote arbitrary command execution.(CVE-2024-24897)","status":"published","published":"2024-03-15T11:06:43Z","modified":"2026-08-18T01:18:18.623988926Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1273","title":"A-Tune-Collector security update","description":"A-Tune-Collector is used to collect various system resources.\r\n\r\nSecurity Fix(es):\r\n\r\nWhen the get method in the sched.py file in the A-Tune-Collector software package is used to obtain the process ID, shell command combination and injection risks exist. This flaw could lead to remote arbitrary command execution.(CVE-2024-24897)","status":"published","published":"2024-03-15T11:06:43Z","modified":"2026-08-18T01:18:18.222120201Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1274","title":"A-Tune-Collector security update","description":"A-Tune-Collector is used to collect various system resources.\r\n\r\nSecurity Fix(es):\r\n\r\nWhen the get method in the sched.py file in the A-Tune-Collector software package is used to obtain the process ID, shell command combination and injection risks exist. This flaw could lead to remote arbitrary command execution.(CVE-2024-24897)","status":"published","published":"2024-03-15T11:06:43Z","modified":"2026-08-18T01:18:18.65304035Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"}]}}