VulnerabilityModified
CVE-2023-0297
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
CRITICAL 9.8EPSS 95.9%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 95.9%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 95.91% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- pyload/pyload
- Source
- security@huntr.dev
References
- http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html
- http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html
- https://github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782dPatch, Third Party Advisory
- https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html
- http://packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html
- https://github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782dPatch, Third Party Advisory
- https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.