CVE-2024-21645
Medium
Description
pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can be used to cover an attacker’s tracks or even to implicate another party in the commission of a malicious act. This vulnerability has been patched in version 0.5.0b3.dev77.
SeverityMedium
CVSS5.3
Exploit probability—
ProductPyload
PublishedJan 8, 2024
First seenJan 8, 2024
Weakness typeCWE-74Injection
How to fix
Update
- pyload-ng0.5.0b3.dev77 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pyload pyload | v ≤ 0.4.9, 0.5.0 | — |
| pyload-ngPyPI | v < 0.5.0b3.dev77 | 0.5.0b3.dev77 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.