CVE-2024-1297

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1297
Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to OS Command Injection.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://fluidattacks.com/advisories/stones Exploit Vendor Advisory
https://github.com/loomio/loomio Product
https://github.com/loomio/loomio/commit/6bc5429bfb5a9c7c811a4487d97ea54a8b23a0fa#diff-b9a7e6b3dfb0fd855c11198a7c53e6f6f90945f28c78cc5dbd960d04d5d28203
https://fluidattacks.com/advisories/stones Exploit Vendor Advisory
https://github.com/loomio/loomio Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:loomio:loomio:2.22.0:*:*:*:*:*:*:*
History

15 Oct 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 10.0 		v2 : unknown
v3 : 7.2

30 Sep 2025, 19:15

Type Values Removed Values Added
Summary (en) Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to OS Command Injection. (en) Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to OS Command Injection.
References
  • () https://github.com/loomio/loomio/commit/6bc5429bfb5a9c7c811a4487d97ea54a8b23a0fa#diff-b9a7e6b3dfb0fd855c11198a7c53e6f6f90945f28c78cc5dbd960d04d5d28203 -

31 Dec 2024, 14:28

Type Values Removed Values Added
First Time Loomio
Loomio loomio
References () https://fluidattacks.com/advisories/stones - () https://fluidattacks.com/advisories/stones - Exploit, Vendor Advisory
References () https://github.com/loomio/loomio - () https://github.com/loomio/loomio - Product
CWE CWE-78
CPE cpe:2.3:a:loomio:loomio:2.22.0:*:*:*:*:*:*:*

21 Nov 2024, 08:50

Type Values Removed Values Added
References () https://fluidattacks.com/advisories/stones - () https://fluidattacks.com/advisories/stones -
References () https://github.com/loomio/loomio - () https://github.com/loomio/loomio -

20 Feb 2024, 19:50

Type Values Removed Values Added
Summary
  • (es) La versión 2.22.0 de Loomio permite ejecutar comandos arbitrarios en el servidor. Esto es posible porque la aplicación es vulnerable a la inyección de comandos del sistema operativo.

20 Feb 2024, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-20 00:15

Updated : 2025-10-15 19:15

NVD link : CVE-2024-1297

Mitre link : CVE-2024-1297

CVE.ORG link : CVE-2024-1297

JSON object : View

Products Affected

loomio

  • loomio
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')