CVE-2024-28848

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Mar 15, 2024
Updated: Mar 21, 2024
CWE ID 94

Summary

CVE-2024-28848 is a vulnerability affecting OpenMetadata, a platform for discovery, observability, and governance. The vulnerability allows authenticated non-admin users to execute arbitrary system commands on the underlying operating system through the CompiledRule::validateExpression method. This is possible because the method evaluates an SpEL expression using an StandardEvaluationContext, enabling it to interact with Java classes such as java.lang.Runtime. The vulnerability can lead to remote code execution and poses a high risk to organizations as it allows unauthorized individuals to execute arbitrary commands on the system. There is also a missing authorization check in the affected path, allowing any authenticated non-admin user to trigger the vulnerable endpoint.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-28848 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options