PT-2023-21858 · Pymedusa · Pymedusa

Pizza-Power · Published 2023-03-27 · Updated 2023-04-04 · CVE-2023-28627

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions pymedusa versions prior to 1.0.12

Description pymedusa is an automatic video library manager for TV Shows. An attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. This allows an attacker to execute arbitrary OS commands as the user running the pymedusa program.

Recommendations For versions prior to 1.0.12, users are advised to upgrade to version 1.0.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-28627

GHSA-6589-X6F5-CGG9

Affected Products

Pymedusa

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28627.json · Exploit
• 🔥 https://github.com/pymedusa/Medusa/security/advisories/GHSA-6589-x6f5-cgg9 · Exploit
• https://github.com/pymedusa/Medusa/commit/66d4be8f0872bd5ddcdc5c5a58cb014d22834a45 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-28627 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28627 · Vendor Advisory
• https://t.me/cibsecurity/60823 · Telegram Post