CVE-2024-21644 (published 2024-01-08T14:15Z)

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/pyload/pyload
commit_details: repo_url: https://github.com/pyload/pyload
author: GammaC0de
author_date: 2024-01-06 01:12:40+02:00
msg: fix GHSA-mqpq-2p68-46fv security advisory
repository: repo_url: https://github.com/pyload/pyload
repo_name: pyload/pyload
description: The free and open-source Download Manager written in pure Python
repo_language: Python
owner: pyload
file_changes: filename: app_blueprint.py
change_type: ModificationType.MODIFY
diff: @@ -452,7 +452,7 @@ def info():
         "os": " ".join((os.name, sys.platform) + extra),
         "version": api.get_server_version(),
         "folder": PKGDIR,
-        "config": api.get_userdir(),
+        "config_folder": api.get_userdir(),
         "download": conf["general"]["storage_folder"]["value"],
         "freespace": format.size(api.free_space()),
         "webif": conf["webui"]["port"]["value"],

programming_language: Python
filename: info.html
change_type: ModificationType.MODIFY
diff: @@ -4,11 +4,11 @@
 <script type="text/javascript" src="{{theme_template('js/info.js')}}"></script>
 {% endblock %}
 
-{% block title %}{{ _("Information") }} - {{ super() }} {% endblock %}
-{% block subtitle %}{{ _("Information") }}{% endblock %}
+{% block title %}{{_("Information")}} - {{super()}} {% endblock %}
+{% block subtitle %}{{_("Information")}}{% endblock %}
 
 {% block content %}
-<h3>{{ _("Support") }}</h3>
+<h3>{{_("Support")}}</h3>
 <ul>
     <li style="font-weight:bold;"><a href="https://pyload.net" target="_blank">Official Website</a></li>
     <li style="font-weight:bold;">
@@ -27,51 +27,51 @@
     </li>
 </ul>
 
-<h3>{{ _("System") }}</h3>
+<h3>{{_("System")}}</h3>
 <table class="system">
     <tr>
-        <td>{{ _("Python version:") }}</td>
-        <td>{{ python }}</td>
+        <td>{{_("Python version:")}}</td>
+        <td>{{python}}</td>
     </tr>
     <tr>
-        <td>{{ _("OS platform:") }}</td>
-        <td>{{ os }}</td>
+        <td>{{_("OS platform:")}}</td>
+        <td>{{os}}</td>
     </tr>
 </table>
 
-<h3>{{ _("Storage") }}</h3>
+<h3>{{_("Storage")}}</h3>
 <table class="system">
     <tr>
-        <td>{{ _("Download folder:") }}</td>
-        <td>{{ download }}</td>
+        <td>{{_("Download folder:")}}</td>
+        <td>{{download}}</td>
     </tr>
     <tr>
-        <td>{{ _("Available space:") }}</td>
-        <td>{{ freespace }}</td>
+        <td>{{_("Available space:")}}</td>
+        <td>{{freespace}}</td>
     </tr>
 </table>
 
-<h3>{{ _("pyLoad") }}</h3>
+<h3>{{_("pyLoad")}}</h3>
 <table class="system">
     <tr>
-        <td>{{ _("Version:") }}</td>
-        <td>{{ version }}</td>
+        <td>{{_("Version:")}}</td>
+        <td>{{version}}</td>
     </tr>
     <tr>
-        <td>{{ _("Installation folder:") }}</td>
-        <td>{{ folder }}</td>
+        <td>{{_("Installation folder:")}}</td>
+        <td>{{folder}}</td>
     </tr>
     <tr>
-        <td>{{ _("Config folder:") }}</td>
-        <td>{{ config }}</td>
+        <td>{{_("Config folder:")}}</td>
+        <td>{{config_folder}}</td>
     </tr>
     <tr>
-        <td>{{ _("Language:") }}</td>
-        <td>{{ language }}</td>
+        <td>{{_("Language:")}}</td>
+        <td>{{language}}</td>
     </tr>
     <tr>
-        <td>{{ _("WebUI port:") }}</td>
-        <td>{{ webif }}</td>
+        <td>{{_("WebUI port:")}}</td>
+        <td>{{webif}}</td>
     </tr>
 </table>
 {% endblock %}

programming_language: HTML
filename: info.html
change_type: ModificationType.MODIFY
diff: @@ -57,7 +57,7 @@
   <dt class="col-xs-12 col-sm-3"><b>{{_('Installation Folder:')}}</b></dt>
   <dd class="col-xs-12 col-sm-9">{{folder}}</dd>
   <dt class="col-xs-12 col-sm-3"><b>{{_('Config Folder:')}}</b></dt>
-  <dd class="col-xs-12 col-sm-9">{{config}}</dd>
+  <dd class="col-xs-12 col-sm-9">{{config_folder}}</dd>
   <dt class="col-xs-12 col-sm-3"><b>{{_('Language:')}}</b></dt>
   <dd class="col-xs-12 col-sm-9">{{language}}</dd>
 </dl>

programming_language: HTML
filename: info.html
change_type: ModificationType.MODIFY
diff: @@ -57,7 +57,7 @@
   <dt class="col-xs-12 col-sm-3"><b>{{_('Installation Folder:')}}</b></dt>
   <dd class="col-xs-12 col-sm-9">{{folder}}</dd>
   <dt class="col-xs-12 col-sm-3"><b>{{_('Config Folder:')}}</b></dt>
-  <dd class="col-xs-12 col-sm-9">{{config}}</dd>
+  <dd class="col-xs-12 col-sm-9">{{config_folder}}</dd>
   <dt class="col-xs-12 col-sm-3"><b>{{_('Language:')}}</b></dt>
   <dd class="col-xs-12 col-sm-9">{{language}}</dd>
 </dl>

programming_language: HTML