CVE-2024-0325 LOW

CVE-2024-0325: Command Injection in Helix Sync

Vendor Helix

Product Sync

Weakness CWE-94 · Code injection

Published February 1, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

3.6/10

Attack vector Local

Attack complexity High

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins.

Key dates

02Disclosure timeline

February 1, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-0325 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html

Related vulnerabilities

04Related CVE

CVE-2026-45583 Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2026-39465 WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability CVE-2026-41249 CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration CVE-2026-52704 WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability CVE-2026-58449 txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter