Frappe: TarSlip RCE in Package Import
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.5%
probabilidade de exploração
0.5%top 63% das CVEs
exploração observada
nãonenhuma fonte reporta
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
frappe · frappeReferências
https://github.com/frappe/frappe/commit/3c75f13fd7d4441a880dd236450277dc37fcddfdhttps://github.com/frappe/frappe/commit/4772e3e7f72db43d48137af74fa77e5fce903223https://github.com/frappe/frappe/commit/57e527d933aeffaec0cd735838701792c848e3e7https://github.com/frappe/frappe/pull/38716https://github.com/frappe/frappe/pull/40044https://github.com/frappe/frappe/pull/40045https://github.com/frappe/frappe/releases/tag/v15.112.0https://github.com/frappe/frappe/releases/tag/v16.23.0https://github.com/frappe/frappe/security/advisories/GHSA-58w2-4cjg-hvp6