onyx --cves cve-2022-24735
CVE-2022-24735
- score
- <0.1
- cvss
- 3.9
- epss
- 2.3%
- published
- 2022-04-27
- kev added
- —
- first seen
Redis < 7.0.0 or 6.2.7 contains a Lua script injection caused by weaknesses in the script execution environment, letting less privileged users inject code that executes with higher privileges, exploit requires access to Redis with Lua scripting enabled.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 10
- https://github.com/redis/redis/pull/10651
- https://github.com/redis/redis/releases/tag/7.0.0
- https://github.com/redis/redis/security/advisories/GHSA-647m-2wmq-qmvq
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPYKSG7LKUJGVM2P72EHXKVRVRWHLORX/
- https://github.com/redis/redis/releases/tag/6.2.7
- https://security.gentoo.org/glsa/202209-17
- https://security.netapp.com/advisory/ntap-20220715-0003/
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4ZK3675DGHVVDOFLJN7WX6YYH27GPMK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSTPUCAPBRHIFPSCOURR4OYX4E2OISAF/