Lucene search

GitHub_MCVELIST:CVE-2020-15142

HistoryAug 14, 2020 - 4:20 p.m.

CVE-2020-15142 Arbitrary Code Generation

2020-08-1416:20:13

CWE-94

GitHub_M

www.cve.org

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.0%

JSON

In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.

CNA Affected

[
  {
    "product": "openapi-python-client",
    "vendor": "triaxtec",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.5.3"
      }
    ]
  }
]

References

github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13

github.com/triaxtec/openapi-python-client/commit/f7a56aae32cba823a77a84a1f10400799b19c19a

github.com/triaxtec/openapi-python-client/security/advisories/GHSA-9x4c-63pf-525f

pypi.org/project/openapi-python-client/

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.0%

JSON

Related for CVELIST:CVE-2020-15142