CVE-2024-28335
2 advisories.
PyPI/lektor CVE-2024-28335: critical 9.1, EPSS 0.85%
Lektor does not sanitize database path traversal
Action: Upgrade lektor to 3.3.11 or later.
pip install lektor==3.3.11pip install lektor==3.4.0b11Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.3.11 | - |
| 3.4.0b1 | 3.4.0b11 | - |
Fixed versions
| 3.3.11 | 3.4.0b11 |
Sources
- osv: GHSA-wv28-7fpw-fj49
- https://nvd.nist.gov/vuln/detail/CVE-2024-28335
- https://github.com/lektor/lektor/pull/1179/commits/8f38b9713d152622b69ff5e3b1e6a0d7bb7fa800
- https://github.com/lektor/lektor/commit/7393d87bd354e43120937789956175064e4610a0
- https://brave.com/privacy-updates/27-localhost-permission
- https://cxsecurity.com/issue/WLB-2024030043
- https://getlektor.com/docs/quickstart
- https://github.com/lektor/lektor/releases/tag/v3.3.11
- https://github.com/pypa/advisory-database/tree/main/vulns/lektor/PYSEC-2024-49.yaml
- https://packetstormsecurity.com/files/177708/Lektor-Static-CMS-3.3.10-Arbitrary-File-Upload-Remote-Code-Execution.html
CVE-2024-28335 · published · modified · JSON
PyPI/lektor CVE-2024-28335: unknown, EPSS 0.85%
Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted
Action: Upgrade lektor to 3.3.11 or later.
pip install lektor==3.3.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.3.11 | - |
Fixed versions
| 3.3.11 |
Sources
- osv: PYSEC-2024-49
- https://github.com/lektor/lektor/pull/1179/commits/8f38b9713d152622b69ff5e3b1e6a0d7bb7fa800
- https://github.com/lektor/lektor/releases/tag/v3.3.11
- https://cxsecurity.com/issue/WLB-2024030043
- https://packetstormsecurity.com/files/177708/Lektor-Static-CMS-3.3.10-Arbitrary-File-Upload-Remote-Code-Execution.html
- https://getlektor.com/docs/quickstart
- https://brave.com/privacy-updates/27-localhost-permission/
- https://github.com/advisories/GHSA-wv28-7fpw-fj49
CVE-2024-28335 · published · modified · JSON