CVE-2013-1630

2013-08-0602:52:10

CWE-20

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.3

Confidence

High

EPSS

0.007

Percentile

80.1%

JSON

pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.

Affected configurations

Nvd

Node

guillaume_gauvritpyshopRange≤0.7

guillaume_gauvritpyshopMatch0.1

guillaume_gauvritpyshopMatch0.2

guillaume_gauvritpyshopMatch0.3

guillaume_gauvritpyshopMatch0.4

guillaume_gauvritpyshopMatch0.5

guillaume_gauvritpyshopMatch0.6

VendorProductVersionCPE
guillaume_gauvritpyshop*cpe:2.3:a:guillaume_gauvrit:pyshop:*:*:*:*:*:*:*:*
guillaume_gauvritpyshop0.1cpe:2.3:a:guillaume_gauvrit:pyshop:0.1:*:*:*:*:*:*:*
guillaume_gauvritpyshop0.2cpe:2.3:a:guillaume_gauvrit:pyshop:0.2:*:*:*:*:*:*:*
guillaume_gauvritpyshop0.3cpe:2.3:a:guillaume_gauvrit:pyshop:0.3:*:*:*:*:*:*:*
guillaume_gauvritpyshop0.4cpe:2.3:a:guillaume_gauvrit:pyshop:0.4:*:*:*:*:*:*:*
guillaume_gauvritpyshop0.5cpe:2.3:a:guillaume_gauvrit:pyshop:0.5:*:*:*:*:*:*:*
guillaume_gauvritpyshop0.6cpe:2.3:a:guillaume_gauvrit:pyshop:0.6:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
guillaume_gauvrit	pyshop	*	cpe:2.3:a:guillaume_gauvrit:pyshop::::::::
guillaume_gauvrit	pyshop	0.1	cpe:2.3:a:guillaume_gauvrit:pyshop:0.1:::::::*
guillaume_gauvrit	pyshop	0.2	cpe:2.3:a:guillaume_gauvrit:pyshop:0.2:::::::*
guillaume_gauvrit	pyshop	0.3	cpe:2.3:a:guillaume_gauvrit:pyshop:0.3:::::::*
guillaume_gauvrit	pyshop	0.4	cpe:2.3:a:guillaume_gauvrit:pyshop:0.4:::::::*
guillaume_gauvrit	pyshop	0.5	cpe:2.3:a:guillaume_gauvrit:pyshop:0.5:::::::*
guillaume_gauvrit	pyshop	0.6	cpe:2.3:a:guillaume_gauvrit:pyshop:0.6:::::::*