GitHub Advisoryadvisory · PyPI

GHSA-58h8-44mg-r43x ReviewBoard and Djblets library are vulnerable to code execution

CRITICAL Published 2022-05-05 Modified 2024-09-20 Official page ↗
Aliases
CVE-2013-4409
Ecosystem
PyPI
Packages
djblets, ReviewBoard
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2023-08-07

Affected packages

• PyPI djblets: < 0.6.30 → fixed in 0.6.30 • PyPI djblets: >= 0.7.0, < 0.7.19 → fixed in 0.7.19 • PyPI ReviewBoard: < 1.7.15 → fixed in 1.7.15

Description

An eval() vulnerability exists in Python Software Foundation Djblets version before 0.6.30 and 0.7.0 before 0.7.19 and Beanbag Review Board before 1.7.15 when parsing JSON requests allowing an attacker to execute arbitrary Python code.

Related

Alias · CVE (1)

  • CVE-2013-4409 An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References