CVE Feed

    Dashboard / CVE / CVE-2023-28627

    CVE-2023-28627

    pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    Published:Mar 27, 2023
    Last Modified:Feb 19, 2025
    EPS:Mar 27, 2023
    EPSS Score:0.00259
    CVSS Score:8.3

    Affected Products

    Vendor
    Pymedusa
    Product
    Medusa

    Exploits

    https://github.com/pymedusa/Medusa/security/advisories/GHSA-6589-x6f5-cgg9https://github.com/pymedusa/Medusa/security/advisories/GHSA-6589-x6f5-cgg9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High