CVE-2024-0937 MEDIUM

CVE-2024-0937: van_der_Schaar LAB synthcity PKL File load_from_file deserialization

Vendor Van_Der_Schaar Lab
Product synthcity
Weakness CWE-502 · Unsafe deserialization
Published January 26, 2024
Last update October 18, 2024
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability, which was classified as critical, has been found in van_der_Schaar LAB synthcity 0.2.9. Affected by this issue is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252182 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early and confirmed immediately the existence of the issue. A patch is planned to be released in February 2024.

Key dates

02Disclosure timeline

January 26, 2024 CVE published
October 18, 2024 Record updated