CVE-2020-28468

Опубликовано: 08 янв. 2021

Источник: nvd

CVSS3: 8.1

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution.

Ссылки

https://github.com/Gallopsled/pwntools/issues/1427
Exploit
Issue Tracking
Third Party Advisory
https://github.com/Gallopsled/pwntools/pull/1732
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-PWNTOOLS-1047345
Exploit
Patch
Third Party Advisory
https://github.com/Gallopsled/pwntools/issues/1427
Exploit
Issue Tracking
Third Party Advisory
https://github.com/Gallopsled/pwntools/pull/1732
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-PWNTOOLS-1047345
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pwntools_project:pwntools:*:*:*:*:*:*:*:*

Версия до 4.3.1 (исключая)

EPSS

Процентиль: 89%

0.04817

Низкий

8.1 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-74

Связанные уязвимости

GHSA-7xc5-ggpp-g249

CVSS3: 9.8

github

почти 5 лет назад

pwntools Server-Side Template Injection (SSTI) vulnerability

EPSS

Процентиль: 89%

0.04817

Низкий

8.1 High

CVSS3

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-74