Low severity · published Jun 28, 2024
CVE-2024-3995
Command Injection in Helix ALM
2.0
CVSS
0.6%
EPSS
No
On KEV
Description
In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Helix ALM · Perforce
0.0.0 before 2024.2.0 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3995
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3995
portal.perforce.com
https://portal.perforce.com/s/detail/a91PA000001SU5pYAG
More from Helix ALM
6.3
CVE-2024-11084
Potential Username Enumeration in Helix ALM
4.9
CVE-2021-28973
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software…