CVE-2024-22416
2 advisories.
PyPI/pyload-ng CVE-2024-22416: critical 9.6, EPSS 0.95%
Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
Action: Upgrade pyload-ng to 0.5.0b3.dev78 or later.
pip install pyload-ng==0.5.0b3.dev78Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.0b3.dev78 | - |
Fixed versions
| 0.5.0b3.dev78 |
Sources
- osv: GHSA-pgpj-v85q-h5fm
- https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fm
- https://nvd.nist.gov/vuln/detail/CVE-2024-22416
- https://github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3e
- https://github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fc
- https://github.com/pyload/pyload
- https://github.com/pypa/advisory-database/tree/main/vulns/pyload-ng/PYSEC-2024-17.yaml
CVE-2024-22416 · published · modified · JSON
PyPI/pyload-ng CVE-2024-22416: high 8.8, EPSS 0.95%
pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`,
Action: Upgrade pyload-ng to 0.5.0b3.dev78 or later.
pip install pyload-ng==0.5.0b3.dev78Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.0b3.dev78 | - |
Fixed versions
| 0.5.0b3.dev78 |
Sources
- osv: PYSEC-2024-17
- https://github.com/pyload/pyload/security/advisories/GHSA-pgpj-v85q-h5fm
- https://github.com/pyload/pyload/commit/1374c824271cb7e927740664d06d2e577624ca3e
- https://github.com/pyload/pyload/commit/c7cdc18ad9134a75222974b39e8b427c4af845fc
CVE-2024-22416 · published · modified · JSON