PT-2023-21858 · Pymedusa · Pymedusa

Pizza-Power · Publicado 2023-03-27 · Atualizado 2023-04-04 · CVE-2023-28627

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions pymedusa versions prior to 1.0.12

Description pymedusa is an automatic video library manager for TV Shows. An attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. This allows an attacker to execute arbitrary OS commands as the user running the pymedusa program.

Recommendations For versions prior to 1.0.12, users are advised to upgrade to version 1.0.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2023-28627

GHSA-6589-X6F5-CGG9

Produtos afetados

Pymedusa

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28627.json · Exploit
• 🔥 https://github.com/pymedusa/Medusa/security/advisories/GHSA-6589-x6f5-cgg9 · Exploit
• https://github.com/pymedusa/Medusa/commit/66d4be8f0872bd5ddcdc5c5a58cb014d22834a45 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-28627 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-28627 · Aviso do Fabricante
• https://t.me/cibsecurity/60823 · Publicação no Telegram