PT-2022-10097 · Gerapy · Gerapy

Rasmus Wriedt Larsen + 1 · Published 2022-01-06 · Updated 2022-02-02 · CVE-2021-32849

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gerapy versions prior to 0.9.9

Description The issue allows an authenticated user to execute arbitrary commands. There are no known workarounds for this problem.

Recommendations For versions prior to 0.9.9, update to version 0.9.9 to resolve the issue. As a temporary workaround, consider restricting access to the system to prevent authenticated users from executing arbitrary commands.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2021-32849

GHSA-756H-R2C9-QP5J

PYSEC-2022-17

Affected Products

Gerapy

References · 13

• 🔥 https://github.com/Gerapy/Gerapy/security/advisories/GHSA-756h-r2c9-qp5j · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2021-076-gerapy · Exploit
• 🔥 https://lgtm.com/projects/g/Gerapy/Gerapy?mode=tree&ruleFocus=1505994646253 · Exploit
• 🔥❌ https://github.com/ohnonoyesyes/CVE-2021-32849 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2021-32849 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32849 · Security Note
• https://osv.dev/vulnerability/GHSA-756h-r2c9-qp5j · Vendor Advisory
• https://github.com/Gerapy/Gerapy · Note
• https://github.com/Gerapy/Gerapy/issues/197 · Note
• https://github.com/Gerapy/Gerapy/issues/217 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/gerapy/PYSEC-2022-17.yaml · Note
• https://t.me/cibsecurity/36355 · Telegram Post