What is the severity of CVE-2024-22836?

CVE-2024-22836 has a critical severity rating due to its potential for arbitrary command execution on the server.

How do I fix CVE-2024-22836?

To fix CVE-2024-22836, upgrade Akaunting to version 3.1.4 or later.

In which versions of Akaunting is CVE-2024-22836 present?

CVE-2024-22836 is present in Akaunting v3.1.3 and earlier versions.

What type of vulnerability is CVE-2024-22836?

CVE-2024-22836 is classified as an OS command injection vulnerability.

Can an attacker exploit CVE-2024-22836 remotely?

Yes, an attacker can exploit CVE-2024-22836 remotely by manipulating the company locale during the app installation process.

Vulnerability/
CVE-2024-22836

Exploited

critical

9.8

CWE

78 77

EPSS

0.447%

8/2/2024

1/8/2024

CVE-2024-22836: OS Command Injection

First published: Thu Feb 08 2024(Updated: )

An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.

Credit: cve@mitre.org u32i

Affected Software	Affected Version	How to fix
Akaunting Akaunting	<3.1.4

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-22836?
CVE-2024-22836 has a critical severity rating due to its potential for arbitrary command execution on the server.
How do I fix CVE-2024-22836?
To fix CVE-2024-22836, upgrade Akaunting to version 3.1.4 or later.
In which versions of Akaunting is CVE-2024-22836 present?
CVE-2024-22836 is present in Akaunting v3.1.3 and earlier versions.
What type of vulnerability is CVE-2024-22836?
CVE-2024-22836 is classified as an OS command injection vulnerability.
Can an attacker exploit CVE-2024-22836 remotely?
Yes, an attacker can exploit CVE-2024-22836 remotely by manipulating the company locale during the app installation process.

agent/type
agent/description
agent/first-publish-date
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/severity
agent/softwarecombine
exploited/true
collector/exploitdb-recent
source/ExploitDB
alias/CVE-2024-22836
agent/references
agent/author
agent/tags
agent/event
collector/epss-latest
source/FIRST
agent/epss
collector/mitre-cve
source/MITRE
agent/weakness
agent/last-modified-date
agent/source
vendor/akaunting
canonical/akaunting akaunting

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2024-22836?
CVE-2024-22836 has a critical severity rating due to its potential for arbitrary command execution on the server.
How do I fix CVE-2024-22836?
To fix CVE-2024-22836, upgrade Akaunting to version 3.1.4 or later.
In which versions of Akaunting is CVE-2024-22836 present?
CVE-2024-22836 is present in Akaunting v3.1.3 and earlier versions.
What type of vulnerability is CVE-2024-22836?
CVE-2024-22836 is classified as an OS command injection vulnerability.
Can an attacker exploit CVE-2024-22836 remotely?
Yes, an attacker can exploit CVE-2024-22836 remotely by manipulating the company locale during the app installation process.