Vulnerability Details : CVE-2023-0297

Public exploit exists!
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
Published 2023-01-14 03:15:19
Updated 2023-06-15 21:15:09
Source huntr.dev
View at NVD,   CVE.org

Products affected by CVE-2023-0297

Exploit prediction scoring system (EPSS) score for CVE-2023-0297

EPSS FAQ
94.86%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2023-0297

  • pyLoad js2py Python Execution
    Disclosure Date: 2023-01-13
    First seen: 2023-09-11
    exploit/linux/http/pyload_js2py_exec
    pyLoad versions prior to 0.5.0b3.dev31 are vulnerable to Python code injection due to the pyimport functionality exposed through the js2py library. An unauthenticated attacker can issue a crafted POST request to the flash/addcrypted2 endpoint to leverage this for code

CVSS scores for CVE-2023-0297

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.8
 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 huntr.dev
9.8
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST

CWE ids for CVE-2023-0297

  • The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
    Assigned by: security@huntr.dev (Primary)

References for CVE-2023-0297

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close