CVE-2023-34457
Medium
Description
MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.
SeverityMedium
CVSS5.9
Exploit probability—
ProductMechanicalsoup
PublishedJul 5, 2023
First seenJul 5, 2023
Weakness typeCWE-20Improper input validation
How to fix
Update
- mechanicalsoup_project mechanicalsoup1.3.0 or later
- mechanicalsoup1.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mechanicalsoup_project mechanicalsoup | v < 1.3.0 | 1.3.0 |
| mechanicalsoupPyPI | 0.2.0 ≤ v < 1.3.0, v < 1.3.0 | 1.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.