CVE-2024-21644

2024-01-0814:15:47

CWE-284

[email protected]

web.nvd.nist.gov

pyload

download manager

python

nvd

cve-2024-21644

security vulnerability

patch

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.118 Low

EPSS

Percentile

95.3%

JSON

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRET_KEY variable. This issue has been patched in version 0.5.0b3.dev77.

Affected configurations

Vulners

NVD

Node

pyloadpyloadRange<0.5.0b3.dev77

VendorProductVersionCPE
pyloadpyload*cpe:2.3:a:pyload:pyload:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pyload	pyload	*	cpe:2.3:a:pyload:pyload::::::::

CNA Affected

[
  {
    "vendor": "pyload",
    "product": "pyload",
    "versions": [
      {
        "version": "< 0.5.0b3.dev77",
        "status": "affected"
      }
    ]
  }
]