PT-2023-8312 · Pyload · Pyload

Gammac0De · Published 2023-01-04 · Updated 2023-01-11 · CVE-2023-0057

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions pyload versions prior to 0.5.0b3.dev33

Description The issue is related to improper restriction of rendered UI layers or frames in the pyload software, which can be exploited by a remote attacker to conduct a clickjacking attack. This allows the attacker to manipulate user interactions.

Recommendations For versions prior to 0.5.0b3.dev33, update to version 0.5.0b3.dev33 or later to resolve the issue. As a temporary workaround, consider restricting access to the UI layers or frames to minimize the risk of exploitation.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

BDU:2024-00426

CVE-2023-0057

GHSA-H8R9-467R-VJJF

Affected Products

Pyload

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0057.json · Exploit
• https://github.com/pyload/pyload/commit/bd2a31b7de54570b919aa1581d486e6ee18c0f64 · Patch
• https://osv.dev/vulnerability/GHSA-h8r9-467r-vjjf · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00426 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-0057 · Security Note
• https://huntr.dev/bounties/12b64f91-d048-490c-94b0-37514b6d694d · Patch
• https://osv.dev/vulnerability/CVE-2023-0057 · Vendor Advisory
• https://github.com/pyload/pyload · Note
• https://t.me/cibsecurity/55927 · Telegram Post
• https://t.me/cvenotify/41808 · Telegram Post