CVE & CISA-KEV Catalog

CVE-2022-24720

CRITICALEPSS 83th pctl
9.8
CVSS v3
NVD

Description

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

CWE-20Improper Input Validation

How to fix

Remediation Available
ruby-image-processingDebian
Fixed in:1.10.3-1+deb11u1CVE-2022-24720
Fixed in:1.10.3-2CVE-2022-24720
ruby-image-processingUbuntu
Fixed in:1.10.3-1ubuntu0.20.04.1USN-6675-1
Fixed in:1.10.3-1ubuntu0.22.04.1USN-6675-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

2.60%probability of exploitation in 30 days
83rdpercentile

Elevated risk: more likely to be exploited than 83% of all known CVEs.

References

Exploit1
Third-Party Advisory1

Related Vulnerabilities

Other CWE-20 (Improper Input Validation) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2024-3400Critical10.0100%KEV + Ransom-
CVE-2021-45105Medium5.9100%-Fix
CVE-2021-44228Critical10.0100%KEV + RansomFix
CVE-2021-21985Critical9.8100%KEV + RansomFix
CVE-2018-7600Critical9.8100%KEV + RansomFix
CVE-2020-3452High7.5100%KEVFix
Embed a live status badge for CVE-2022-24720
CVE-2022-24720 severity badge

Markdown

[![CVE-2022-24720](https://tridentstack.com/cve/badge/CVE-2022-24720.svg)](https://tridentstack.com/cve/CVE-2022-24720)

HTML

<a href="https://tridentstack.com/cve/CVE-2022-24720"><img src="https://tridentstack.com/cve/badge/CVE-2022-24720.svg" alt="CVE-2022-24720"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.