CVE-2024-29189 HIGH

CVE-2024-29189: ansys-geometry-core OS Command Injection vulnerability

Vendor Ansys
Product pyansys-geometry
Weakness CWE-78
Published March 26, 2024
Last update August 5, 2024
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Local
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

PyAnsys Geometry is a Python client library for the Ansys Geometry service and other CAD Ansys products. On file src/ansys/geometry/core/connection/product_instance.py, upon calling this method _start_program directly, users could exploit its usage to perform malicious operations on the current machine where the script is ran. This vulnerability is fixed in 0.3.3 and 0.4.12.

Key dates

02Disclosure timeline

March 26, 2024 CVE published
August 5, 2024 Record updated