CVE-2022-35411

Katalog CVE

CVSS 9.8 · Critical EPSS 45,7%

Kerentanan Insufficiently Protected Credentials pada rpc.py project rpc.py. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.

Rincian

Terbit di NVD

8 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

45,7% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/abersheeran/rpc.py/commit/491e7a841ed9a754796d6ab047a9fb16e23bf8bd patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/167872/rpc.py-0.6.0-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/ehtec/rpcpy-exploit exploit · advisory pihak ketiga
• https://medium.com/%40elias.hohl/remote-code-execution-0-day-in-rpc-py-709c76690c30 exploit