PT-2023-12419 · Unknown · Nyuccl Psiturk

Blaiserideout · Publicado 2023-01-28 · Atualizado 2024-05-17 · CVE-2021-4315

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NYUCCL psiTurk versions up to 3.2.0

Description A critical issue has been found in NYUCCL psiTurk, affecting unknown code of the file psiturk/experiment.py. The manipulation of the mode argument leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue.

Recommendations For NYUCCL psiTurk versions up to 3.2.0, upgrade to version 3.2.1 to address the issue. As a temporary workaround, consider restricting the manipulation of the mode argument in the affected file psiturk/experiment.py until the upgrade is applied.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-1336

CWE-94

Identificadores relacionados

CVE-2021-4315

GHSA-9MQ4-9556-6QXQ

PYSEC-2023-43

Produtos afetados

Nyuccl Psiturk

Referências · 14

• 🔥 https://github.com/NYUCCL/psiTurk/pull/517 · Exploit
• https://github.com/NYUCCL/psiTurk/releases/tag/v3.2.1 · Correção
• https://github.com/NYUCCL/psiTurk/commit/47787e15cecd66f2aa87687bf852ae0194a4335f · Correção
• https://github.com/NYUCCL/psiTurk · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/psiturk/PYSEC-2023-43.yaml · Nota
• https://osv.dev/vulnerability/GHSA-9mq4-9556-6qxq · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-4315 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-43 · Aviso do Fabricante
• https://t.me/cvenotify/43810 · Publicação no Telegram
• https://vuldb.com/?id.219676 · Nota
• https://osv.dev/vulnerability/CVE-2021-4315 · Aviso do Fabricante
• https://t.me/cvenotify/43020 · Publicação no Telegram
• https://t.me/cibsecurity/57132 · Publicação no Telegram
• https://vuldb.com/?ctiid.219676 · Nota