Lucene search

K
githubGitHub Advisory DatabaseGHSA-QC99-G3WM-HGXR
HistoryMay 01, 2022 - 5:44 p.m.

Django Arbitrary Code Execution

2022-05-0117:44:04
GitHub Advisory Database
github.com
5
django
arbitrary code execution
bin/compile-messages.py
msgfmt
os.system
shell metacharacters
.po file
.mo file

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8

Confidence

High

EPSS

0.01

Percentile

83.4%

bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.

Affected configurations

Vulners
Node
django-registration_projectdjango-registrationMatch0.95django
CPENameOperatorVersion
djangoeq0.95

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

8

Confidence

High

EPSS

0.01

Percentile

83.4%