Lucene search

K
osvGoogleOSV:GHSA-6X4H-9622-FQR6
HistoryDec 13, 2023 - 1:35 p.m.

Improper validation in meraki

2023-12-1313:35:16
Google
osv.dev
13
improper validation
aiohttp 3.9.0
meraki software

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.1%

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.

meraki from version 1.40.1 requires aiohttp 3.9.0

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.1%