CVE-2023-46404

PCRS <= 3.11 (d0de1e) Questions page and Code editor page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
VendorProductVersion
utorontopcrs
𝑥
≤ 3.11
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://bitbucket.org/utmandrew/pcrs/commits/5f18bcbb383b7d73f7a8b399cc52b23597d752ae
https://github.com/windecks/CVE-2023-46404
https://bitbucket.org/utmandrew/pcrs/commits/5f18bcbb383b7d73f7a8b399cc52b23597d752ae
https://github.com/windecks/CVE-2023-46404