PYSEC-2022-264

    Dashboard / Vulnerabilities / PYSEC-2022-264

    PYSEC-2022-264

    Published: 7 Sept 2022Last Modified: 8 Nov 2023

    Summary:

    Details: mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http, https), mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in local disk for each line of website contents. Version 1.7.2 contains a patch for this issue.

    References: https://github.com/mansuf/mangadex-downloader/commit/439cc2825198ebc12b3310c95c39a8c7710c9b42, https://github.com/mansuf/mangadex-downloader/security/advisories/GHSA-r9x7-2xmr-v8fw

    Affected packages

    Package

    Name: mangadex-downloader

    Purl: pkg:pypi/mangadex-downloader

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -439cc2825198ebc12b3310c95c39a8c7710c9b42

    Affected versions

    1.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2022-264 | CVE-DB