{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-0937","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2024-01-26T10:59:28.493Z","datePublished":"2024-01-26T17:31:03.957Z","dateUpdated":"2024-10-18T14:55:12.279Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2024-02-09T19:12:33.080Z"},"title":"van_der_Schaar LAB synthcity PKL File load_from_file deserialization","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-502","lang":"en","description":"CWE-502 Deserialization"}]}],"affected":[{"vendor":"van_der_Schaar LAB","product":"synthcity","versions":[{"version":"0.2.9","status":"affected"}],"modules":["PKL File Handler"]}],"descriptions":[{"lang":"en","value":"A vulnerability, which was classified as critical, has been found in van_der_Schaar LAB synthcity 0.2.9. Affected by this issue is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252182 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early and confirmed immediately the existence of the issue. A patch is planned to be released in February 2024."},{"lang":"de","value":"Eine kritische Schwachstelle wurde in van_der_Schaar LAB synthcity 0.2.9 entdeckt. Dies betrifft die Funktion load_from_file der Komponente PKL File Handler. Durch das Manipulieren mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung."}],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P"}}],"timeline":[{"time":"2024-01-26T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-01-26T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-01-26T12:04:47.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"bayuncao (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.252182","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.252182","tags":["signature","permissions-required"]},{"url":"https://github.com/bayuncao/vul-cve-6","tags":["broken-link"]},{"url":"https://github.com/bayuncao/vul-cve-6/blob/main/poc.py","tags":["broken-link","exploit"]}]},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-01T18:18:19.144Z"},"title":"CVE Program Container","references":[{"url":"https://vuldb.com/?id.252182","tags":["vdb-entry","technical-description","x_transferred"]},{"url":"https://vuldb.com/?ctiid.252182","tags":["signature","permissions-required","x_transferred"]},{"url":"https://github.com/bayuncao/vul-cve-6","tags":["broken-link","x_transferred"]},{"url":"https://github.com/bayuncao/vul-cve-6/blob/main/poc.py","tags":["broken-link","exploit","x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-18T14:54:46.782773Z","id":"CVE-2024-0937","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-10-18T14:55:12.279Z"}}]}}