CVE-2018-15747

Published: Jun 21, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file.

Affected (1)

Products: Glot: Glot Www

Glot

1 product

Glot Www

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Glot Glot Www	Up to 2018-05-19

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://github.com/prasmussen/glot-code-runner/issues/15

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/prasmussen/glot-code-runner/issues/15

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.