CVE-2017-2810

An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
Configurations

Configuration 1 (hide)

cpe:2.3:a:python:tablib:0.11.4:*:*:*:*:*:*:*

History

21 Nov 2024, 03:24

Type Values Removed Values Added
CVSS v2 : 7.5
v3 : 9.8
v2 : 7.5
v3 : 7.5
References () http://www.securityfocus.com/bid/99076 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/99076 - Third Party Advisory, VDB Entry
References () https://security.gentoo.org/glsa/201811-18 - () https://security.gentoo.org/glsa/201811-18 -
References () https://talosintelligence.com/vulnerability_reports/TALOS-2017-0307 - Exploit, Third Party Advisory, VDB Entry () https://talosintelligence.com/vulnerability_reports/TALOS-2017-0307 - Exploit, Third Party Advisory, VDB Entry

Information

Published : 2017-06-14 13:29

Updated : 2024-11-21 03:24


NVD link : CVE-2017-2810

Mitre link : CVE-2017-2810

CVE.ORG link : CVE-2017-2810


JSON object : View

Products Affected

python

  • tablib