CVE-2024-28397

EUVD-2024-2066
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA-ADPADP
5.3 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-cloudscraper
focal
dne
jammy
dne
mantic
dne
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
Common Weakness Enumeration
References
https://github.com/Marven11
https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
https://github.com/Marven11
https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape