CVE-2023-34457

2023-07-0520:15:10

CWE-20

[email protected]

web.nvd.nist.gov

mechanicalsoup

python library

cve-2023-34457

web automation

security vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

25.4%

JSON

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a <input type="file" ...> inside HTML form. All users of MechanicalSoup’s form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.

Affected configurations

Vulners

NVD

Node

mechanicalsoupmechanicalsoupRange0.2.0–1.3.0

CPENameOperatorVersion
mechanicalsoup_project:mechanicalsoupmechanicalsoup project mechanicalsouplt1.3.0

CPE	Name	Operator	Version
mechanicalsoup_project:mechanicalsoup	mechanicalsoup project mechanicalsoup	lt	1.3.0

CNA Affected

[
  {
    "vendor": "MechanicalSoup",
    "product": "MechanicalSoup",
    "versions": [
      {
        "version": ">= 0.2.0, < 1.3.0",
        "status": "affected"
      }
    ]
  }
]