LOWCVSS v3.1 2.7Vulnerability
CVE-2024-4412
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
Properties
- Severity
- LOW
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Epss score
- 0.0028
- Cvss severity
- LOW
- Cvss score
- 2.7
- Retrieved at
- 2026-10-21T01:24:47+00:00
- Last source
- FIRST EPSS
- Score
- 2.7
- Cvss version
- 3.1
- Cve id
- CVE-2024-4412
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-10-19T19:31:52+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-10-19T17:16:57.837
- Last modified
- 2026-10-20T20:17:09.900
- Epss percentile
- 0.19255
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph