VulnerabilityDeferred

CVE-2024-7093

Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed.

CRITICAL 9.4EPSS 0.51%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.51%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then executed whenever these notifications are rendered and sent out.

CVSS 4.0: 9.4 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.51% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-94
Source: security-report@netflix.com

References

https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-003.md

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.