rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-47575 
An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. The web interfaces of the Relyum devices are susceptible to reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-47576 
An issue was discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices, allowing authenticated command injection through the web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-47577 
An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-47578 
Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices are susceptible to Cross Site Request Forgery (CSRF) attacks due to the absence of CSRF protection in the web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-47579 
Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-12-13T00:00:00.000Z
CVE-2023-47580 
Multiple improper restriction of operations within the bounds of a memory buffer issues exist in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. If a user opens a specially crafted file (X1, V8, or V9 file), information may be disclosed and/or arbitrary code may be executed.

Problem types: description: Improper restriction of operations within the bounds of a memory buffer
Affected products: vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: TELLUS
vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: TELLUS Lite
Published: 2023-11-15T05:40:43.526Z
CVE-2023-47581 
Out-of-bounds read vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. If a user opens a specially crafted file (X1, V8, or V9 file), information may be disclosed and/or arbitrary code may be executed.
Problem types: description: Out-of-bounds read
Affected products: vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: TELLUS
vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: TELLUS Lite
Published: 2023-11-15T05:40:54.802Z
CVE-2023-47582 
Access of uninitialized pointer vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. If a user opens a specially crafted file (X1, V8, or V9 file), information may be disclosed and/or arbitrary code may be executed.
Problem types: description: Access of uninitialized pointer
Affected products: vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: TELLUS
vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: TELLUS Lite
Published: 2023-11-15T05:41:09.146Z
CVE-2023-47583 
Multiple out-of-bounds read vulnerabilities exist in TELLUS Simulator V4.0.17.0 and earlier. If a user opens a specially crafted file (X1 or V9 file), information may be disclosed and/or arbitrary code may be executed.
Problem types: description: Out-of-bounds read
Affected products: vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: TELLUS Simulator
Published: 2023-11-15T05:41:35.113Z
CVE-2023-47584 
Out-of-bounds write vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file, information may be disclosed and/or arbitrary code may be executed.

Problem types: description: Out-of-bounds write
Affected products: vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: V-Server
vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: V-Server Lite
Published: 2023-11-15T06:03:19.425Z
CVE-2023-47585 
Out-of-bounds read vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file, information may be disclosed and/or arbitrary code may be executed.
Problem types: description: Out-of-bounds read
Affected products: vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: V-Server
vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: V-Server Lite
Published: 2023-11-15T06:03:31.138Z
CVE-2023-47586 
Multiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file, information may be disclosed and/or arbitrary code may be executed.
Problem types: description: Heap-based buffer overflow
Affected products: vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: V-Server
vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: V-Server Lite
Published: 2023-11-15T06:03:46.888Z
CVE-2023-47609 
SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request.
Problem types: description: SQL Injection
Affected products: vendor: Thinkingreed Inc.
product: OSS Calendar
Published: 2023-11-14T05:12:19.484Z
CVE-2023-47610 
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input
Affected products: vendor: Telit Cinterion
product: EHS5
default_status: affected
vendor: Telit Cinterion
product: EHS6
default_status: affected
vendor: Telit Cinterion
product: EHS8
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Alexander Kozlov from Kaspersky
lang: en
value: Sergey Anufrienko from Kaspersky
Published: 2023-11-09T17:05:38.207Z
CVE-2023-47612 
A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to obtain a read/write access to any files and directories on the targeted system, including hidden files and directories.
Problem types: cwe_id: CWE-552
description: CWE-552: Files or Directories Accessible to External Parties
Affected products: vendor: Telit Cinterion
product: BGS5
default_status: affected
vendor: Telit Cinterion
product: EHS5
default_status: affected
vendor: Telit Cinterion
product: EHS6
default_status: affected
vendor: Telit Cinterion
product: EHS8
default_status: affected
vendor: Telit Cinterion
product: PDS5
default_status: affected
vendor: Telit Cinterion
product: PDS6
default_status: affected
vendor: Telit Cinterion
product: PDS8
default_status: affected
vendor: Telit Cinterion
product: ELS61
default_status: affected
vendor: Telit Cinterion
product: ELS81
default_status: affected
vendor: Telit Cinterion
product: PLS62
default_status: affected
CVSS v3.1: version: 3.1
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: Alexander Kozlov from Kaspersky
lang: en
value: Sergey Anufrienko from Kaspersky
Published: 2023-11-09T12:07:54.815Z
CVE-2023-47613 
A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to escape from virtual directories and get read/write access to protected files on the targeted system.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: Telit Cinterion
product: BGS5
default_status: affected
vendor: Telit Cinterion
product: EHS5
default_status: affected
vendor: Telit Cinterion
product: EHS6
default_status: affected
vendor: Telit Cinterion
product: EHS8
default_status: affected
vendor: Telit Cinterion
product: PDS5
default_status: affected
vendor: Telit Cinterion
product: PDS6
default_status: affected
vendor: Telit Cinterion
product: PDS8
default_status: affected
vendor: Telit Cinterion
product: ELS61
default_status: affected
vendor: Telit Cinterion
product: ELS81
default_status: affected
vendor: Telit Cinterion
product: PLS62
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Credits: lang: en
value: Alexander Kozlov from Kaspersky
lang: en
value: Sergey Anufrienko from Kaspersky
Published: 2023-11-09T06:32:08.024Z
CVE-2023-47615 
A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to get access to a sensitive data on the targeted system.
Problem types: cwe_id: CWE-526
description: CWE-526: Exposure of Sensitive Information Through Environmental Variables
Affected products: vendor: Telit Cinterion
product: BGS5
default_status: affected
vendor: Telit Cinterion
product: EHS5
default_status: affected
vendor: Telit Cinterion
product: EHS6
default_status: affected
vendor: Telit Cinterion
product: EHS8
default_status: affected
vendor: Telit Cinterion
product: PDS5
default_status: affected
vendor: Telit Cinterion
product: PDS6
default_status: affected
vendor: Telit Cinterion
product: PDS8
default_status: affected
vendor: Telit Cinterion
product: ELS61
default_status: affected
vendor: Telit Cinterion
product: ELS81
default_status: affected
vendor: Telit Cinterion
product: PLS62
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Credits: lang: en
value: Alexander Kozlov from Kaspersky
lang: en
value: Sergey Anufrienko from Kaspersky
Published: 2023-11-09T12:47:43.253Z
CVE-2023-47616 
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow an attacker with physical access to the target system to get access to a sensitive data on the targeted system.
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Telit Cinterion
product: BGS5
default_status: affected
vendor: Telit Cinterion
product: EHS5
default_status: affected
vendor: Telit Cinterion
product: EHS6
default_status: affected
vendor: Telit Cinterion
product: EHS8
default_status: affected
vendor: Telit Cinterion
product: PDS5
default_status: affected
vendor: Telit Cinterion
product: PDS6
default_status: affected
vendor: Telit Cinterion
product: PDS8
default_status: affected
vendor: Telit Cinterion
product: ELS61
default_status: affected
vendor: Telit Cinterion
product: ELS81
default_status: affected
vendor: Telit Cinterion
product: PLS62
default_status: affected
CVSS v3.1: version: 3.1
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 2.4
baseSeverity: LOW
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Credits: lang: en
value: Alexander Kozlov from Kaspersky
lang: en
value: Sergey Anufrienko from Kaspersky
Published: 2023-11-09T12:24:33.382Z
CVE-2023-47617 
A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Tp-Link
product: ER7206 Omada Gigabit VPN Router
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
Published: 2024-02-06T16:20:13.079Z
CVE-2023-47618 
A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Problem types: cwe_id: CWE-78
description: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Tp-Link
product: ER7206 Omada Gigabit VPN Router
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
Credits: lang: en
value: Discovered by the Vulnerability Discovery and Research team of Cisco Talos.
Published: 2024-02-06T16:20:12.604Z
CVE-2023-47619 Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability
Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of time of publication, no patches are available.
Problem types: cwe_id: CWE-918
description: CWE-918: Server-Side Request Forgery (SSRF)
cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: advplyr
product: audiobookshelf
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2023-12-13T21:02:34.389Z
CVE-2023-47620 Scrypted reflected Cross-site Scripting vulnerability
Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the `owner' and 'pkg` parameters. An attacker can run arbitrary JavaScript code.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: koush
product: scrypted
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-12-13T21:49:41.624Z
CVE-2023-47621 Remote code execution via file uploads in guest-entries 
Guest Entries is a php library which allows users to create, update & delete entries from the front-end of a site. In affected versions the file uploads feature did not prevent the upload of PHP files. This may lead to code execution on the server by authenticated users. This vulnerability is fixed in v3.1.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: duncanmcclean
product: guest-entries
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-11-13T20:02:22.652Z
CVE-2023-47622 iTop vulnerable to XSS vulnerability in dashlet refresh
iTop is an IT service management platform.  When dashlet are refreshed, XSS attacks are possible.  This vulnerability is fixed in 3.0.4 and 3.1.1.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Combodo
product: iTop
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-04-15T17:34:01.226Z
CVE-2023-47623 Scrypted reflected Cross-site Scripting vulnerability
Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the login page via the `redirect_uri` parameter. By specifying a url with the javascript scheme (`javascript:`), an attacker can run arbitrary JavaScript code after the login.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: koush
product: scrypted
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2023-12-13T21:38:14.451Z
CVE-2023-47624 Audiobookshelf Arbitrary File Read Vulnerability
Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, any user (regardless of their permissions) may be able to read files from the local file system due to a path traversal in the `/hls` endpoint. This issue may lead to Information Disclosure. As of time of publication, no patches are available.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: advplyr
product: audiobookshelf
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-12-13T21:09:00.688Z
CVE-2023-47625 Global Buffer Overflow leading to denial of service in PX4-Autopilot
PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParser_TryParseCrsfPacket function in /src/drivers/rc/crsf_rc/CrsfParser.cpp:298 due to the invalid size check. A malicious user may create an RC packet remotely and that packet goes into the device where the _rcs_buf reads. The global buffer overflow vulnerability will be triggered and the drone can behave unexpectedly. This issue has been addressed in version 1.14.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Problem types: cwe_id: CWE-120
description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: PX4
product: PX4-Autopilot
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.9
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-11-13T20:40:56.752Z
CVE-2023-47626 iTop vulnerable to XSS vulnerability in authent-token
iTop is an IT service management platform.  When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Combodo
product: iTop
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-04-15T17:36:08.437Z
CVE-2023-47627 Request smuggling in aiohttp
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.
Problem types: cwe_id: CWE-444
description: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: vendor: aio-libs
product: aiohttp
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2023-11-14T20:48:48.076Z