CVE-2020-15120
2 advisories.
PyPI/ihatemoney CVE-2020-15120: medium 4.9, EPSS 1.03%
Authorization Bypass in I hate money
Action: Upgrade ihatemoney to 4.1.5 or later.
pip install ihatemoney==4.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.1.5 | - |
Fixed versions
| 4.1.5 |
Sources
- osv: GHSA-67j9-c52g-w2q9
- https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9
- https://nvd.nist.gov/vuln/detail/CVE-2020-15120
- https://github.com/spiral-project/ihatemoney/commit/8d77cf5d5646e1d2d8ded13f0660638f57e98471
- https://github.com/pypa/advisory-database/tree/main/vulns/ihatemoney/PYSEC-2020-264.yaml
- https://github.com/spiral-project/ihatemoney
CVE-2020-15120 · published · modified · JSON
PyPI/ihatemoney CVE-2020-15120: unknown, EPSS 1.03%
In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be fur
Action: Upgrade ihatemoney to 4.1.5 or later.
pip install ihatemoney==4.1.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.1.5 | - |
Fixed versions
| 4.1.5 |
Sources
- osv: PYSEC-2020-264
- https://github.com/spiral-project/ihatemoney/security/advisories/GHSA-67j9-c52g-w2q9
- https://github.com/spiral-project/ihatemoney/commit/8d77cf5d5646e1d2d8ded13f0660638f57e98471
CVE-2020-15120 · published · modified · JSON