CVE-2023-48699
High
Description
fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function `def __locator__(self, locator_name: str)` in `page.py`. In order to mitigate this issue, upgrade to fastbots version 0.1.5 or above.
SeverityHigh
CVSS8.4
Exploit probability—
ProductUbertidavide Fastbots
PublishedNov 21, 2023
First seenNov 21, 2023
Weakness typeCWE-95CWE-95
How to fix
Update
- ubertidavide fastbots0.1.5 or later
- fastbots0.1.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubertidavide fastbots | v < 0.1.5 | 0.1.5 |
| fastbotsPyPI | v < 0.1.5 | 0.1.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.