CVE-2024-48746
Published: 05 November 2024
Summary
CVE-2024-48746 is a critical-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-48746 affects the Lens Visual integration with Power BI version 4.0.0.3. The flaw resides in the natural language processing component and is tracked under CWE-77, enabling remote arbitrary code execution with a CVSS 3.1 score of 9.8.
A remote attacker can exploit the issue over the network without authentication or user interaction, achieving full control over confidentiality, integrity, and availability on the affected system. The single available reference is a public gist that documents the vulnerability but supplies no official mitigation guidance or patch information.
The associated EPSS score has remained flat at 0.0743 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43081
Vulnerability details
An issue in Lens Visual integration with Power BI v.4.0.0.3 allows a remote attacker to execute arbitrary code via the Natural language processing component
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.