PT-2023-19403 · Pypi+1 · Request+1

Di1L0O · Published 2023-02-22 · Updated 2025-03-13 · CVE-2023-24107

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions hour of code python 2015 version 520929797b9ca43bb818b2e8f963fb2025459fa3

Description The issue allows attackers to access sensitive user information and execute arbitrary code via a code execution backdoor in the request package, as specified in requirements.txt.

Recommendations For hour of code python 2015 version 520929797b9ca43bb818b2e8f963fb2025459fa3, consider removing or updating the request package in requirements.txt to prevent code execution backdoors. As a temporary workaround, restrict access to sensitive user information until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-24107

Affected Products

Hour Of Code Python 2015

Request

References · 8

• 🔥 https://github.com/jminh/hour_of_code_python_2015/issues/4 · Exploit
• https://osv.dev/vulnerability/CVE-2023-24107 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24107 · Security Note
• https://github.com/jminh/hour_of_code_python_2015 · Note
• https://t.me/cibsecurity/58679 · Telegram Post
• https://t.me/cvenotify/114744 · Telegram Post
• https://mirrors.neusoft.edu.cn/pypi/web/simple/request · Note
• https://t.me/cvenotify/45372 · Telegram Post