Lucene search

[email protected]CVE-2013-4409

HistoryNov 04, 2019 - 9:15 p.m.

CVE-2013-4409

2019-11-0421:15:11

CWE-20

[email protected]

web.nvd.nist.gov

cve-2013-4409

python

software foundation

vulnerability

djblets

beanbag

review board

json

parsing

eval()

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.016 Low

EPSS

Percentile

87.6%

JSON

An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests.

Affected configurations

Vulners

NVD

Node

python_software_foundation\;_beanbagdjbletsRange≤0.7.21

python_software_foundation\;_beanbagreview_boardRange≤1.7.15

CPENameOperatorVersion
reviewboard:djbletsreviewboard djbletseq0.7.21
reviewboard:review_boardreviewboard review boardlt1.7.15

CPE	Name	Operator	Version
reviewboard:djblets	reviewboard djblets	eq	0.7.21
reviewboard:review_board	reviewboard review board	lt	1.7.15

CNA Affected

[
  {
    "product": "Djblets",
    "vendor": "Python Software Foundation; Beanbag",
    "versions": [
      {
        "status": "affected",
        "version": "0.7.21"
      }
    ]
  },
  {
    "product": "Review Board",
    "vendor": "Python Software Foundation; Beanbag",
    "versions": [
      {
        "status": "affected",
        "version": "before 1.7.15"
      }
    ]
  }
]