Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xNzRmLXJmMjctOGh4Y84AA2zZ

OpenCRX allows a remote attacker to execute arbitrary code via a crafted request

An issue in OpenCRX v.5.2.2 allows a remote attacker to execute arbitrary code via a crafted request.

Permalink: https://github.com/advisories/GHSA-q74f-rf27-8hxc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xNzRmLXJmMjctOGh4Y84AA2zZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 1 year ago
Updated: about 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00315
EPSS Percentile: 0.7103

Identifiers: GHSA-q74f-rf27-8hxc, CVE-2023-46502
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-46502
• https://github.com/opencrx/opencrx/commit/ce7a71db0bb34ecbcb0e822d40598e410a48b399
• https://gist.github.com/spookhorror/9519fc66d3946e887e4a86c06ddbee0e
• https://github.com/advisories/GHSA-q74f-rf27-8hxc

Repository: https://github.com/opencrx/opencrx
Blast Radius: 1.0

Affected Packages