GitHub Advisoryadvisory · PyPI

GHSA-q5h6-49gg-2wfg GramAddict bot uses dependency with reverse tcp backdoor

HIGH Published 2022-05-24 Modified 2024-09-20 Official page ↗
Aliases
CVE-2020-36245
Ecosystem
PyPI
Packages
GramAddict
Severity
High
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306, CWE-94
Reviewed
2024-04-22

Affected packages

• PyPI GramAddict: < 1.2.5 → fixed in 1.2.5

Description

GramAddict before 1.2.5 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

Related

Alias · CVE (1)

  • CVE-2020-36245 GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. vulnerability

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-94 Improper Control of Generation of Code weakness

References