An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
References
| Link | Resource |
|---|---|
| https://joel-malwarebenchmark.github.io | Exploit Third Party Advisory |
| https://joel-malwarebenchmark.github.io/blog/2020/04/27/cve-2020-13388-jw-util-vulnerability/ | Exploit Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20200528-0002/ | Third Party Advisory |
| https://joel-malwarebenchmark.github.io | Exploit Third Party Advisory |
| https://joel-malwarebenchmark.github.io/blog/2020/04/27/cve-2020-13388-jw-util-vulnerability/ | Exploit Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20200528-0002/ | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://joel-malwarebenchmark.github.io - Exploit, Third Party Advisory | |
| References | () https://joel-malwarebenchmark.github.io/blog/2020/04/27/cve-2020-13388-jw-util-vulnerability/ - Exploit, Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20200528-0002/ - Third Party Advisory |
Information
Published : 2020-05-22 17:15
Updated : 2024-11-21 05:01
NVD link : CVE-2020-13388
Mitre link : CVE-2020-13388
CVE.ORG link : CVE-2020-13388
JSON object : View
Products Affected
python
- jw.util
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')