GitHub Advisoryadvisory · PyPI

GHSA-pmv9-3xqp-8w42 Mesop has a local file Inclusion via static file serving functionality

HIGH Published 2024-09-18 Modified 2024-09-18 Official page ↗
Aliases
CVE-2024-45601
Ecosystem
PyPI
Packages
mesop
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20, CWE-22
Reviewed
2024-09-18

Affected packages

• PyPI mesop: >= 0.9.0, < 0.12.4 → fixed in 0.12.4

Description

A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served. Users are strongly advised to update to the latest version of Mesop immediately. The latest version includes a fix for this vulnerability. We would like to thank @Letm3through for reporting this issue and proposing mitigations to address this issue.

Related

Alias · CVE (1)

  • CVE-2024-45601 Mesop is a Python-based UI framework designed for rapid web apps development. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References