GitHub Advisoryadvisory · PyPI

GHSA-9jp4-68vc-r8wq FormEncode Access Restrictions Bypass

HIGH Published 2022-05-17 Modified 2024-09-20 Official page ↗
Aliases
CVE-2008-6547
Ecosystem
PyPI
Packages
FormEncode
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2024-02-09

Affected packages

• PyPI FormEncode: >= 1.0, < 1.0.1 → fixed in 1.0.1

Description

`schema.py` in FormEncode for Python (python-formencode) 1.0 does not apply the `chained_validators` feature, which allows attackers to bypass intended access restrictions via unknown vectors.

Related

Alias · CVE (1)

  • CVE-2008-6547 schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References