CVE-2022-38792 : The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution

The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party.

Published 2022-08-27 20:15:08

Updated 2022-09-01 19:36:17

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-38792

Exotel Project » Exotel » Version: 0.1.6 For Python
cpe:2.3:a:exotel_project:exotel:0.1.6:*:*:*:*:python:*:*
Matching versions

EPSS FAQ

0.42%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 74 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

https://github.com/jertel/elastalert2/pull/931

Pin exotel dependency to 0.1.5 due to security issue in 0.1.6 by anroots-tw · Pull Request #931 · jertel/elastalert2 · GitHub
Issue Tracking;Patch;Third Party Advisory
https://pypi.org/project/exotel/

exotel · PyPI
Product;Third Party Advisory
https://github.com/sarathsp06/exotel-py/issues/10

Malicious version 0.1.6 of exotel python package released to PyPi · Issue #10 · sarathsp06/exotel-py · GitHub
Issue Tracking;Third Party Advisory
https://inspector.pypi.io/project/exotel/0.1.6/packages/8b/ed/9ebeb34d4adb9b01151d73ccfde9c1cb2d629c3b146953c8727559a65446/exotel-0.1.6.tar.gz/exotel-0.1.6/setup.py

Third Party Advisory

Jump to