CVE-2022-35411

    Dashboard / Vulnerabilities / CVE-2022-35411

    CVE-2022-35411

    Published: 8 Jul 2022Last Modified: 12 Aug 2026

    Summary:

    Details: rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.

    References: http://packetstormsecurity.com/files/167872/rpc.py-0.6.0-Remote-Code-Execution.html, https://medium.com/%40elias.hohl/remote-code-execution-0-day-in-rpc-py-709c76690c30, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35411.json, https://nvd.nist.gov/vuln/detail/CVE-2022-35411, https://github.com/abersheeran/rpc.py/commit/491e7a841ed9a754796d6ab047a9fb16e23bf8bd, https://github.com/ehtec/rpcpy-exploit

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 2875170a69fe1c7b84d33eb9d2bcd4441d776b96
    Fixed -491e7a841ed9a754796d6ab047a9fb16e23bf8bd

    Affected versions

    v0.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-35411 | CVE-DB