Lucene search

Veracode Vulnerability DatabaseVERACODE:46611

HistoryApr 25, 2024 - 5:33 a.m.

Remote Code Execution

2024-04-2505:33:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability; remote code execution; software; file path handling; template rendering; authenticated user; crafted template file

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

pyload_ng is vulnerable to remote code execution (RCE). The vulnerability is due to improper file path handling and template rendering, allowing an authenticated user to upload and execute a crafted template file.

CPENameOperatorVersion
pyload-ngle0.5.0b3.dev82
pyload-ngle0.5.0b3.dev82

CPE	Name	Operator	Version
	pyload-ng	le	0.5.0b3.dev82
	pyload-ng	le	0.5.0b3.dev82

References

github.com/pyload/pyload/security/advisories/GHSA-3f7w-p8vr-4v5f

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for VERACODE:46611