GitHub Advisoryadvisory · PyPI

GHSA-2894-qcqf-g23g asyncua Improper Authentication vulnerability

HIGH Published 2023-10-03 Modified 2023-10-04 Official page ↗
Aliases
CVE-2023-26150
Ecosystem
PyPI
Packages
asyncua
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-287
Reviewed
2023-10-04

Affected packages

• PyPI asyncua: < 0.9.96 → fixed in 0.9.96

Description

Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. Note: This issue is a result of missing checks for services that require an active session.

Related

Alias · CVE (1)

  • CVE-2023-26150 Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References