CVE-2022-40424

The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-networking package. The affected version of d8s-urls is 0.1.0

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/democritus-project/d8s-urls/issues/9	Exploit Issue Tracking Third Party Advisory
https://pypi.org/project/democritus-networking/	Not Applicable
https://github.com/democritus-project/d8s-urls/issues/9	Exploit Issue Tracking Third Party Advisory
https://pypi.org/project/democritus-networking/	Not Applicable

Configurations

Configuration 1 (hide)

cpe:2.3:a:democritus_urls_project:democritus_urls:0.1.0:*:*:*:*:python:*:*

History

21 Nov 2024, 07:21

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-09-19 15:15

Updated : 2024-11-21 07:21

NVD link : CVE-2022-40424

Mitre link : CVE-2022-40424

CVE.ORG link : CVE-2022-40424

JSON object : View

Products Affected

democritus_urls_project

democritus_urls

CWE

NVD-CWE-Other

{"id": "CVE-2022-40424", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-09-19T15:15:13.560", "references": [{"url": "https://github.com/democritus-project/d8s-urls/issues/9", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://pypi.org/project/democritus-networking/", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://github.com/democritus-project/d8s-urls/issues/9", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://pypi.org/project/democritus-networking/", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-networking package. The affected version of d8s-urls is 0.1.0"}, {"lang": "es", "value": "d8s-urls para python, tal y como es distribuido en PyPI, inclu\u00eda una potencial puerta trasera de ejecuci\u00f3n de c\u00f3digo insertada por un tercero. Una potencial puerta trasera de ejecuci\u00f3n de c\u00f3digo insertada por terceros es el paquete democritus-networking. La versi\u00f3n afectada de d8s-urls es 0.1.0"}], "lastModified": "2024-11-21T07:21:22.630", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:democritus_urls_project:democritus_urls:0.1.0:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "16BDEB17-DFD1-4A5E-80A7-EE5F328756FD"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}