js2py up to 0.74 API Call js2py.disable_pyimport privilege escalation

Summaryinfo

A vulnerability identified as problematic has been detected in js2py up to 0.74. This affects the function js2py.disable_pyimport of the component API Call Handler. Performing a manipulation results in an unknown weakness. This vulnerability is identified as CVE-2024-28397. Additionally, an exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in js2py up to 0.74. This affects the function js2py.disable_pyimport of the component API Call Handler. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-28397 since 03/08/2024. Technical details and a public exploit are known.

The exploit is shared for download at packetstormsecurity.com. It is declared as highly functional.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (52532). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• js2py

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51
• 0.52
• 0.53
• 0.54
• 0.55
• 0.56
• 0.57
• 0.58
• 0.59
• 0.60
• 0.61
• 0.62
• 0.63
• 0.64
• 0.65
• 0.66
• 0.67
• 0.68
• 0.69
• 0.70
• 0.71
• 0.72
• 0.73
• 0.74

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion