CVE-2022-24735

What it is

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. The Lua script execution environment in Redis provides some measures that prevent a script from creating side effects that persist and can affect the execution of the same, or different script, at a later time. Several weaknesses of these measures have been publicly known for a long time, but they had no security impact as the Redis security model did not endorse the concept of users or privileges. With the introduction of ACLs in Redis 6.0, these weaknesses can be exploited by a less privileged users to inject Lua code that will execute at a later time, when a privileged user executes a Lua script. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account, but needs a user to act. Limited direct impact.

Exploit odds

2.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2022-04-27 20:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 04:32 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 2.2% in the next 30 days (EPSS).
• Severity: 3.9 LOW (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2022-04-27 20:15 UTC

Last modified

2026-06-17 04:32 UTC

Exploit probability

2.2% · EPSS, next 30 days

Weakness

CWE-94 · Code injection

Record status

Modified

Affected

• Redis < 6.2.7
• Redis 7.0
• Fedoraproject Fedora 34
• Fedoraproject Fedora 35
• Fedoraproject Fedora 36
• Netapp Management Services For Element Software
• Netapp Management Services For Netapp Hci
• Oracle Communications Operations Monitor 4.3

Attack profile CVSS 3.1 · 3.9

Attack vector

Local

Complexity

Low

Privileges needed

Low

User interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2022-24735.md and follow it. Check whether this project is affected by CVE-2022-24735. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge