Skip to main content

Pypi CVE-2022-34501

CRITICAL
2022-07-22 cve@mitre.org
RCE Pypi
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 22, 2022 - 15:15 nvd
CRITICAL 9.8

DescriptionNVD

The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party.

AnalysisAI

The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party. Affected products include: Pypi.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Pypi

View all
CVE-2022-34056 CRITICAL POC
9.8 Jun 24

The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package. Rated
CVE-2022-34055 CRITICAL POC
9.8 Jun 24

The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. Rated c
CVE-2022-34054 CRITICAL POC
9.8 Jun 24

The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package
CVE-2022-34053 CRITICAL POC
9.8 Jun 24

The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package.

CVE-2022-33004 CRITICAL POC
9.8 Jun 24

The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request packag
CVE-2022-33003 CRITICAL POC
9.8 Jun 24

The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package
CVE-2022-33002 CRITICAL POC
9.8 Jun 24

The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request packa
CVE-2022-33001 CRITICAL POC
9.8 Jun 24

The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package. Rated cr
CVE-2022-33000 CRITICAL POC
9.8 Jun 24

The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request pack
CVE-2022-32999 CRITICAL POC
9.8 Jun 24

The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. Ra
CVE-2022-32998 CRITICAL POC
9.8 Jun 24

The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via
CVE-2022-32997 CRITICAL POC
9.8 Jun 24

The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the requ

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2022-34501 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy