{"schema":"threatline.record/2","record":{"id":"CVE-2024-3955","aliases":["GHSA-4f92-w438-f484","PYSEC-2026-308"],"summary":"CraftBeerPi 4 allows arbitrary code execution","details":"URL GET parameter \"logtime\" utilized within the \"downloadlog\" function from \"cbpi/http_endpoints/http_system.py\" is subsequently passed to the \"os.system\" function in \"cbpi/controller/system_controller.py\" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).","categories":["Libraries & packages"],"product":"cbpi4","vendor":"PiBrewing","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4f92-w438-f484","source_modified_at":"2026-10-27T16:20:49Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"pip","name":"cbpi4"},"range":">= 4.0.0.58, < 4.4.1.a1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3955","source_modified_at":"2024-08-01T20:26:57.228Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"CraftBeerPi 4","vendor":"PiBrewing","versions":[{"lessThan":"4.4.1.a1 (commit 57572c7)","status":"affected","version":"4.0.0.58 (commit 563fae9)","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3955","source_modified_at":"2024-08-01T20:26:57.228Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"CraftBeerPi 4","vendor":"CraftBeerPi - Brewing Controller","versions":[{"lessThanOrEqual":"*","status":"affected","version":"4.0.0.58 (commit 563fae9)","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4f92-w438-f484","source_modified_at":"2026-06-29T12:26:44.612917942Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"cbpi4","ecosystem":"PyPI","purl":"pkg:pypi/cbpi4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.58"},{"fixed":"4.4.1.a1"}]}],"versions":["4.0.5","4.0.5a13","4.0.5a14","4.0.5a15","4.0.5a16","4.0.6","4.0.7","4.0.7rc1","4.0.7rc3","4.1.0","4.1.0a2","4.1.0a3","4.1.0rc1","4.1.0rc2","4.1.0rc5","4.1.0rc8","4.1.10","4.1.10rc2","4.1.11","4.1.2","4.1.6","4.1.7","4.1.7rc1","4.2.0","4.2.0a6","4.2.0rc1","4.3.0","4.3.1","4.3.2","4.4.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4f92-w438-f484","source_modified_at":"2026-10-27T16:20:49Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"pip","name":"cbpi4"},"version":"4.4.1.a1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-3955","source_modified_at":"2024-08-01T20:26:57.228Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"CraftBeerPi 4","ecosystem":null},"version":"4.4.1.a1 (commit 57572c7)","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4f92-w438-f484","source_modified_at":"2026-06-29T12:26:44.612917942Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"cbpi4","ecosystem":"PyPI","purl":"pkg:pypi/cbpi4"},"version":"4.4.1.a1"}],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.01149,"percentile":0.66681,"score_date":"2026-10-27"},"published_at":"2024-05-02T09:43:51.941Z","modified_at":"2026-10-27T16:20:49Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-4f92-w438-f484","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T16:20:49Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-3955","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2024-08-01T20:26:57.228Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-4f92-w438-f484","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-06-29T12:26:44.612917942Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-3955","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3955","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/PiBrewing/craftbeerpi4/issues/132","tags":["issue-tracking","x_transferred"]},{"url":"https://cert.pl/en/posts/2024/05/CVE-2024-3955","source":"GitHub Advisory Database"},{"url":"https://cert.pl/posts/2024/05/CVE-2024-3955","source":"GitHub Advisory Database"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cbpi4/PYSEC-2026-308.yaml","source":"GitHub Advisory Database"},{"url":"https://pypi.org/project/cbpi4","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-4f92-w438-f484","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://cert.pl/en/posts/2024/05/CVE-2024-3955/","tags":["third-party-advisory","x_transferred"]},{"source":"CVE List","url":"https://cert.pl/posts/2024/05/CVE-2024-3955/","tags":["third-party-advisory","x_transferred"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2024-05-02T17:35:00.248697Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T16:20:49Z","content_hash":"95f88d966438f2a88a0a5d38766d5695f65716658a161054dc4cb7cf0b4020fa"}}