mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-07 05:28:59 +00:00
60 lines
2.9 KiB
JSON
60 lines
2.9 KiB
JSON
{
|
|
"id": "CVE-2024-47821",
|
|
"sourceIdentifier": "security-advisories@github.com",
|
|
"published": "2024-10-25T23:15:02.530",
|
|
"lastModified": "2024-10-28T13:58:09.230",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions prior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in `/scripts` path and using the `/flashgot` API to download the file. This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. Version 0.5.0b3.dev87 fixes this issue."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "pyLoad es un gestor de descargas gratuito y de c\u00f3digo abierto. La carpeta `/.pyload/scripts` contiene scripts que se ejecutan cuando se completan determinadas acciones, por ejemplo, cuando finaliza una descarga. Al descargar un archivo ejecutable en una carpeta en /scripts y realizar la acci\u00f3n correspondiente, se puede lograr la ejecuci\u00f3n remota de c\u00f3digo en versiones de la rama 0.5 anteriores a 0.5.0b3.dev87. Se puede descargar un archivo en una carpeta de este tipo cambiando la carpeta de descarga a una carpeta en la ruta `/scripts` y utilizando la API `/flashgot` para descargar el archivo. Esta vulnerabilidad permite a un atacante con acceso cambiar la configuraci\u00f3n en un servidor pyload para ejecutar c\u00f3digo arbitrario y comprometer por completo el sistema. La versi\u00f3n 0.5.0b3.dev87 soluciona este problema."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "security-advisories@github.com",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
|
"baseScore": 9.1,
|
|
"baseSeverity": "CRITICAL",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "HIGH",
|
|
"userInteraction": "NONE",
|
|
"scope": "CHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "HIGH"
|
|
},
|
|
"exploitabilityScore": 2.3,
|
|
"impactScore": 6.0
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "security-advisories@github.com",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-78"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://github.com/pyload/pyload/security/advisories/GHSA-w7hq-f2pj-c53g",
|
|
"source": "security-advisories@github.com"
|
|
}
|
|
]
|
|
} |