Remote Code Execution Vulnerability in pyLoad Prior to 0.5.0b3.dev87
CVE-2024-47821

2.3LOW

Key Information:

Vendor
Pyload
Status
Pyload
Vendor
CVE Published:
25 October 2024

Summary

The vulnerability exposes pyLoad Download Manager users to a remote code execution risk due to flaws in the handling of scripts within the /.pyload/scripts directory. Attackers who can modify settings on a pyLoad server may exploit this vulnerability by downloading an executable file to the scripts directory and triggering the execution through specific actions like completing a download. Such exploitation can lead to full system compromise. Version 0.5.0b3.dev87 addresses this vulnerability, ensuring enhanced security for users.

Affected Version(s)

pyload < 0.5.0b3.dev87

References

https://github.com/pyload/pyload/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.