Skip to main content

Aix CVE-2024-47115

HIGH
OS Command Injection (CWE-78)
2024-12-07 psirt@us.ibm.com
7.8
CVSS 3.1 · Vendor: us
Share

Severity by source

Vendor (us) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (us) · only source for this CVE.

CVSS VectorVendor: us

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 07, 2024 - 13:19 cve.org
HIGH 7.8

DescriptionCVE.org

IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input.

AnalysisAI

IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. IBM AIX 7.2, 7.3 and VIOS 3.1 and 4.1 could allow a local user to execute arbitrary commands on the system due to improper neutralization of input. Affected products include: Ibm Vios, Ibm Aix.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.

More in Aix

View all
CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak

CVE-2013-4011 HIGH POC
7.2 Jul 18

Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a

CVE-2023-28528 HIGH POC
7.8 Apr 28

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c

CVE-2016-3053 HIGH POC
7.8 Feb 01

IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile

CVE-2016-6079 HIGH POC
7.8 Feb 15

IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob

CVE-2016-8972 HIGH POC
7.8 Feb 15

IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the

CVE-2014-8904 HIGH POC
7.2 Jan 15

lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM

CVE-2012-2179 MEDIUM POC
6.9 Jun 22

libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar

CVE-2014-3977 MEDIUM POC
6.9 Jun 08

libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on

CVE-2026-18835 CRITICAL
9.9 Aug 20

OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru

CVE-2026-16816 CRITICAL
9.9 Aug 19

OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar

CVE-2026-15068 CRITICAL
9.9 Aug 19

OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands

Share

CVE-2024-47115 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy