CVE-2020-7698 Command Injection
Attackers can execute arbitrary commands via unsanitized input in the project_configure endpoint of Gerapy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7698?
CVE-2020-7698 is a high-severity command injection vulnerability in Gerapy, published on 29 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.
Weakness: CWE-78
Which versions are affected by CVE-2020-7698?
3 open source packages ship an affected version, including gerapy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gerapy PyPI | All versions | 0.9.3 |
gerapy PyPI | All versions | 0.9.3 |
gerapy PyPI | All versions | 0.9.3 |
Products include Gerapy Gerapy.
How do I fix CVE-2020-7698?
Upgrade gerapy to 0.9.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-7698 being exploited?
There is no known exploitation of CVE-2020-7698 in the wild and no public exploit code.
Other vulnerabilities in Gerapy
Sources
Also known as GHSA-g57j-q48p-9vm2, PYSEC-2020-44, SNYK-PYTHON-GERAPY-572470.