CVE-2024-12652 CRITICAL

CVE-2024-12652: Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')

Vendor Intumit
Product SmartRobot′s Conversational AI Platform
Weakness CWE-94 · Code injection
Published December 26, 2024
Last update December 26, 2024
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H

What the vulnerability does

01Description

A Improper Control of Generation of Code ('Code Injection') vulnerability in groovy script function in SmartRobot′s Conversational AI Platform before v7.2.0 allows remote authenticated users to perform arbitrary system commands via Groovy code.

Key dates

02Disclosure timeline

December 26, 2024 CVE published
December 26, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-53626 pdfme has Sandbox Escape and Prototype Pollution vulnerabilities in pdfme expression evaluation CVE-2024-10959 Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.5 - Unauthenticated Arbitrary Shortcode Execution via woot_get_smth CVE-2021-38117 Possible Remote Code Execution Vulnerability OpenText iManager CVE-2026-44513 Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components CVE-2024-0196 Magic-Api code injection