Open-source backdoor
Malicious code merged upstream by a trusted contributor
categoryCloud, container and supply chain attacksseverityVery Highlabnot yet measured
Example: XZ Utils
Classification
18 values: 8 reviewed, 8 imported, 2 derived. What do these mean?
Exploitability
| Attack vector | Software vulnerabilitiesSupply chain |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Attacker skill required | High |
| Resources required | High |
| Likelihood / prevalence | Low |
| Maturity | Emerging |
Impact & scope
| Severity | Very High |
|---|---|
| Impact | AvailabilityConfidentialityIntegrity |
| Environment | CloudOn-premises |
| Target asset class | ServerSupply chain |
Detection & response
No linked mitigations or detections yet.
Framework references
- Primary source: https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
- cve: CVE-2024-3094 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Cloud, container and supply chain attacks' table, line 432 of Cyber-Attack-Taxonomy.md
- ev-0002 (FIRST EPSS scores) — FIRST EPSS for CVE-2024-3094: epss=0.85974 percentile=0.99719 (score date 2026-09-18).
- ev-0003 (NVD CVE API 2.0) — NVD maps CVE-2024-3094 to weakness(es) CWE-506.