{"id":"CVE-2024-24899","aliases":["EUVD-2024-22262","GHSA-5gv4-m6hr-96m6","OESA-2024-1291","OESA-2024-1292","OESA-2024-1293","OESA-2024-1294"],"status":"published","title":"Command injection in aops-zeus","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.\n\nThis issue affects aops-zeus: from 1.2.0 through 1.4.0.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01689,"percentile":0.77216,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2024-03-15T11:06:44Z","modified":"2026-08-18T01:18:19Z","fixes":[{"ecosystem":"openEuler:22.03-LTS-SP3","package":"aops-zeus","fixed_in":["v1.4.0-7.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"aops-zeus","fixed_in":["v1.3.1-6.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"aops-zeus","fixed_in":["v1.2.0-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"aops-zeus","fixed_in":["v1.2.1-3.oe2203sp2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"aops-zeus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.4.0-7.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"aops-zeus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.3.1-6.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"aops-zeus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.2.0-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"aops-zeus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.2.1-3.oe2203sp2"}]}]}],"products":[{"vendor":"openeuler","product":"aops-zeus"}],"references":[{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1292","tags":["x_transferred"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1293","tags":["x_transferred"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1294","tags":["x_transferred"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1291","tags":["x_transferred"]},{"url":"https://gitee.com/src-openeuler/aops-zeus/pulls/108","tags":["x_transferred"]},{"url":"https://gitee.com/src-openeuler/aops-zeus/pulls/107","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24899","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5gv4-m6hr-96m6"},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1291","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1292","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1293","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1294","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-24899","title":"Command injection in aops-zeus","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.\n\nThis issue affects aops-zeus: from 1.2.0 through 1.4.0.\n\n","status":"published","published":"2024-03-25T07:13:13.251Z","modified":"2024-08-12T18:43:05.811Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:13.64024Z"}],"euvd":[{"id":"EUVD-2024-22262","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.\n\nThis issue affects aops-zeus: from 1.2.0 through 1.4.0.\n\n","status":"published","published":"2024-03-25T07:13:13Z","modified":"2024-08-12T18:43:05Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:19.748102Z"}],"ghsa":[{"id":"GHSA-5gv4-m6hr-96m6","title":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')...","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.\n\nThis issue affects aops-zeus: from 1.2.0 through 1.4.0.\n\n","status":"published","published":"2024-03-25T09:32:33Z","modified":"2024-03-25T09:32:39Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:55:43.067988Z"}],"nvd":[{"id":"CVE-2024-24899","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py.\n\nThis issue affects aops-zeus: from 1.2.0 through 1.4.0.\n\n","status":"published","published":"2024-03-25T07:15:50.56Z","modified":"2026-06-17T07:15:11.29Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"OESA-2024-1291","title":"aops-zeus security update","description":"A host and user manager service which is the foundation of aops.\r\n\r\nSecurity Fix(es):\r\n\r\nIn aops-zeus software versions 1.2.0~1.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be executed on the remote host, which may cause the remote host system to crash, suffering serious consequences of security threats and losses.(CVE-2024-24899)","status":"published","published":"2024-03-15T11:06:44Z","modified":"2026-08-18T01:18:19.002892414Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1292","title":"aops-zeus security update","description":"A host and user manager service which is the foundation of aops.\r\n\r\nSecurity Fix(es):\r\n\r\nIn aops-zeus software versions 1.2.0~1.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be executed on the remote host, which may cause the remote host system to crash, suffering serious consequences of security threats and losses.(CVE-2024-24899)","status":"published","published":"2024-03-15T11:06:44Z","modified":"2026-08-18T01:18:18.857002838Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1293","title":"aops-zeus security update","description":"A host and user manager service which is the foundation of aops.\r\n\r\nSecurity Fix(es):\r\n\r\nIn aops-zeus software versions 1.2.0~1.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be executed on the remote host, which may cause the remote host system to crash, suffering serious consequences of security threats and losses.(CVE-2024-24899)","status":"published","published":"2024-03-15T11:06:44Z","modified":"2026-08-18T01:18:18.934612152Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1294","title":"aops-zeus security update","description":"A host and user manager service which is the foundation of aops.\r\n\r\nSecurity Fix(es):\r\n\r\nIn aops-zeus software versions 1.2.0~1.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be executed on the remote host, which may cause the remote host system to crash, suffering serious consequences of security threats and losses.(CVE-2024-24899)","status":"published","published":"2024-03-15T11:06:44Z","modified":"2026-08-18T01:17:12.383455341Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"}]}}