CVE-2024-42360.yml

---
gem: sequenceserver
cve: 2024-42360
ghsa: qv32-5wm2-p32h
url: https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h
title: Command Injection in sequenceserver gem
date: 2024-08-13
description: |
  ### Impact

  Several HTTP endpoints did not properly sanitize user input
  and/or query parameters. This could be exploited to inject
  and run unwanted shell commands

  ### Patches

  Fixed in 3.1.2

  ### Workarounds

  No known workarounds
cvss_v3: 9.8
patched_versions:
  - ">= 3.1.2"
related:
  url:
    - https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h
    - https://github.com/wurmlab/sequenceserver/commit/457e52709f7f9ed2fceed59b3db564cb50785dba
    - https://github.com/advisories/GHSA-qv32-5wm2-p32h