CVE-2024-29433 - Vulnerability Details - OpenCVE

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Alldata	Alldata

Configuration 1 [-]

cpe:2.3:a:alldata:alldata:0.4.6:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://gist.github.com/Raybye/496a871c66715a531750d58651d2b5c4

History

Tue, 15 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00072}`	epss `{'score': 0.00095}`

Wed, 07 May 2025 01:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Alldata Alldata alldata
CPEs		cpe:2.3:a:alldata:alldata:0.4.6:::::::*
Vendors & Products		Alldata Alldata alldata

Wed, 04 Sep 2024 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-502
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-04-01T00:00:00

Updated: 2024-09-04T15:57:51.349Z

Reserved: 2024-03-19T00:00:00

Link: CVE-2024-29433

Vulnrichment

Updated: 2024-08-02T01:10:55.425Z

NVD

Status : Analyzed

Published: 2024-04-01T20:15:14.117

Modified: 2025-05-07T00:36:03.690

Link: CVE-2024-29433

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-29433", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-09-04T15:57:51.349Z", "dateReserved": "2024-03-19T00:00:00", "datePublished": "2024-04-01T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-01T20:02:04.081053"}, "descriptions": [{"lang": "en", "value": "A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://gist.github.com/Raybye/496a871c66715a531750d58651d2b5c4"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:10:55.425Z"}, "title": "CVE Program Container", "references": [{"url": "https://gist.github.com/Raybye/496a871c66715a531750d58651d2b5c4", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "affected": [{"vendor": "alldata", "product": "alldata", "cpes": ["cpe:2.3:a:alldata:alldata:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0.4.6", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-15T13:38:59.952334Z", "id": "CVE-2024-29433", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-04T15:57:51.349Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://gist.github.com/Raybye/496a871c66715a531750d58651d2b5c4", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:10:55.425Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-29433", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-15T13:38:59.952334Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:alldata:alldata:*:*:*:*:*:*:*:*"], "vendor": "alldata", "product": "alldata", "versions": [{"status": "affected", "version": "0.4.6"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-14T20:01:58.329Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://gist.github.com/Raybye/496a871c66715a531750d58651d2b5c4"}], "descriptions": [{"lang": "en", "value": "A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-04-01T20:02:04.081053"}}}, "cveMetadata": {"cveId": "CVE-2024-29433", "state": "PUBLISHED", "dateUpdated": "2024-09-04T15:57:51.349Z", "dateReserved": "2024-03-19T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-04-01T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}