CVE-2024-23347

{"id": "CVE-2024-23347", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-01-16T18:15:11.267", "references": [{"url": "https://www.facebook.com/security/advisories/cve-2024-23347", "tags": ["Vendor Advisory"], "source": "cve-assign@fb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application."}, {"lang": "es", "value": "Antes de v176, al abrir un nuevo proyecto, Meta Spark Studio ejecutaba scripts definidos dentro de un archivo package.json incluido como parte de ese proyecto. Esos scripts tendr\u00edan la capacidad de ejecutar c\u00f3digo arbitrario en el sistema como aplicaci\u00f3n."}], "lastModified": "2024-01-30T15:09:12.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:facebook:meta_spark_studio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A2477AC-6870-4B94-B74E-BA1DBEC2F2DD", "versionEndExcluding": "176"}], "operator": "OR"}]}], "sourceIdentifier": "cve-assign@fb.com"}