CVE-2024-0521
CRITICAL9.3EPSS 0.10%Code Injection in paddlepaddle
發布日:2024/1/20修改日:2024/2/16
描述
The vulnerability arises from the way the url parameter is incorporated into the command string without proper validation or sanitization. If the url is constructed from untrusted sources, an attacker could potentially inject malicious commands.
受影響套件(1)
- PyPI/paddlepaddlefrom 0, < 2.6.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.3 | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |