CVE-2024-48990

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published
Nov 19, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-489917.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race conditionCVE-2024-489927.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart intCVE-2024-489938.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489948.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489958.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489968.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489978.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489988.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-489998.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-49006.1The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above rolCVE-2024-490008.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-490018.8SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-48990: High severity, CVSS 7.8 | Vulnix