PYSEC-2024-17

    Dashboard / Vulnerabilities / PYSEC-2024-17

    PYSEC-2024-17

    Published: 18 Jan 2024Last Modified: 29 Jan 2024

    Summary:

    Details: pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.

    References: https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fm, https://github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3e, https://github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fc

    Affected packages

    Package

    Name: pyload-ng

    Purl: pkg:pypi/pyload-ng

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1374c824271cb7e927740664d06d2e577624ca3e

    Affected versions

    0.5.0a5.dev528
    0.5.0a5.dev532
    0.5.0a5.dev535
    0.5.0a5.dev536
    0.5.0a5.dev537
    0.5.0a5.dev539
    0.5.0a5.dev540
    0.5.0a5.dev545
    0.5.0a5.dev562
    0.5.0a5.dev564
    0.5.0a5.dev565
    0.5.0a6.dev570
    0.5.0a6.dev578
    0.5.0a6.dev587
    0.5.0a7.dev596
    0.5.0a8.dev602
    0.5.0a9.dev615
    0.5.0a9.dev629
    0.5.0a9.dev632
    0.5.0a9.dev641
    0.5.0a9.dev643
    0.5.0a9.dev655
    0.5.0a9.dev806
    0.5.0b1.dev1
    0.5.0b1.dev2
    0.5.0b1.dev3
    0.5.0b1.dev4
    0.5.0b1.dev5
    0.5.0b2.dev10
    0.5.0b2.dev11
    0.5.0b2.dev12
    0.5.0b2.dev9
    0.5.0b3.dev13
    0.5.0b3.dev14
    0.5.0b3.dev17
    0.5.0b3.dev18
    0.5.0b3.dev19
    0.5.0b3.dev20
    0.5.0b3.dev21
    0.5.0b3.dev22
    0.5.0b3.dev24
    0.5.0b3.dev26
    0.5.0b3.dev27
    0.5.0b3.dev28
    0.5.0b3.dev29
    0.5.0b3.dev30
    0.5.0b3.dev31
    0.5.0b3.dev32
    0.5.0b3.dev33
    0.5.0b3.dev34
    0.5.0b3.dev35
    0.5.0b3.dev38
    0.5.0b3.dev39
    0.5.0b3.dev40
    0.5.0b3.dev41
    0.5.0b3.dev42
    0.5.0b3.dev43
    0.5.0b3.dev44
    0.5.0b3.dev45
    0.5.0b3.dev46
    0.5.0b3.dev47
    0.5.0b3.dev48
    0.5.0b3.dev49
    0.5.0b3.dev50
    0.5.0b3.dev51
    0.5.0b3.dev52
    0.5.0b3.dev53
    0.5.0b3.dev54
    0.5.0b3.dev57
    0.5.0b3.dev60
    0.5.0b3.dev62
    0.5.0b3.dev64
    0.5.0b3.dev65
    0.5.0b3.dev66
    0.5.0b3.dev67
    0.5.0b3.dev68
    0.5.0b3.dev69
    0.5.0b3.dev70
    0.5.0b3.dev71
    0.5.0b3.dev72
    0.5.0b3.dev73
    0.5.0b3.dev74
    0.5.0b3.dev75
    0.5.0b3.dev76
    0.5.0b3.dev77

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2024-17 | CVE-DB