CVE-2020-28468

This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
snykCNA
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 88%
VendorProductVersion
pwntools_projectpwntools
𝑥
< 4.3.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/Gallopsled/pwntools/issues/1427
https://github.com/Gallopsled/pwntools/pull/1732
https://snyk.io/vuln/SNYK-PYTHON-PWNTOOLS-1047345
https://github.com/Gallopsled/pwntools/issues/1427
https://github.com/Gallopsled/pwntools/pull/1732
https://snyk.io/vuln/SNYK-PYTHON-PWNTOOLS-1047345