Lucene search

MitreCVE-2023-46404

HistoryNov 03, 2023 - 4:15 p.m.

CVE-2023-46404

2023-11-0316:15:31

CWE-94

mitre

web.nvd.nist.gov

pcrs

3.11

d0de1e

questions

code editor

rce

python sandboxing

remote code execution

vulnerability

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.002

Percentile

54.1%

JSON

PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.

Affected configurations

Nvd

Node

utorontopcrsRange≤3.11

VendorProductVersionCPE
utorontopcrs*cpe:2.3:a:utoronto:pcrs:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
utoronto	pcrs	*	cpe:2.3:a:utoronto:pcrs::::::::

References

bitbucket.org/utmandrew/pcrs/commits/5f18bcbb383b7d73f7a8b399cc52b23597d752ae

github.com/windecks/CVE-2023-46404

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.002

Percentile

54.1%

JSON

Related for CVE-2023-46404