GitHub Advisoryadvisory · crates.io, PyPI

GHSA-73v2-rxqp-7q4f aliyundrive-webdav vulnerable to Command Injection

HIGH Published 2024-03-29 Modified 2024-03-29 Official page ↗
Aliases
CVE-2024-29640
Ecosystem
crates.io, PyPI
Packages
aliyundrive-webdav
Severity
High
Weaknesses
CWE-77
Reviewed
2024-03-29

Affected packages

• crates.io aliyundrive-webdav: <= 2.3.3 (no fix yet) • PyPI aliyundrive-webdav: <= 2.3.3 (no fix yet)

Description

An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the `action_query_qrcode` component.

Related

Alias · CVE (1)

  • CVE-2024-29640 An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References