Skip to main content

Pypi CVE-2022-34053

CRITICAL
2022-06-24 cve@mitre.org
RCE Pypi Dr Web Engine
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 24, 2022 - 21:15 nvd
CRITICAL 9.8

DescriptionNVD

The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

AnalysisAI

The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges. Affected products include: Pypi Dr-Web-Engine.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Pypi

View all
CVE-2022-34056 CRITICAL POC
9.8 Jun 24

The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package. Rated
CVE-2022-34055 CRITICAL POC
9.8 Jun 24

The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. Rated c
CVE-2022-34054 CRITICAL POC
9.8 Jun 24

The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package
CVE-2022-33004 CRITICAL POC
9.8 Jun 24

The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request packag
CVE-2022-33003 CRITICAL POC
9.8 Jun 24

The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package
CVE-2022-33002 CRITICAL POC
9.8 Jun 24

The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request packa
CVE-2022-33001 CRITICAL POC
9.8 Jun 24

The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package. Rated cr
CVE-2022-33000 CRITICAL POC
9.8 Jun 24

The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request pack
CVE-2022-32999 CRITICAL POC
9.8 Jun 24

The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. Ra
CVE-2022-32998 CRITICAL POC
9.8 Jun 24

The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via
CVE-2022-32997 CRITICAL POC
9.8 Jun 24

The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the requ
CVE-2022-32996 CRITICAL POC
9.8 Jun 24

The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the reques

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2022-34053 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy