CVE-2025-5175

Katalog CVE

CVSS 5.5 · Medium EPSS 0,24%

Kerentanan Incorrect Privilege Assignment pada erdogant pypickle. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as critical. This affects the function Save of the file pypickle/pypickle.py. The manipulation leads to improper authorization. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named 14b4cae704a0bb4eb6723e238f25382d847a1917. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

26 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-285: Improper Authorization

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/erdogant/pypickle/issues/3 exploit · issue tracking · advisory vendor
• https://github.com/erdogant/pypickle/issues/3#issue-3070689116 exploit · issue tracking · advisory vendor
• https://github.com/erdogant/pypickle/issues/3#issuecomment-2888589652 exploit · issue tracking · advisory vendor
• https://github.com/erdogant/pypickle/commit/14b4cae704a0bb4eb6723e238f25382d847a1917 patch
• https://vuldb.com/?id.310263 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.579824 advisory pihak ketiga · vdb entry
• https://github.com/erdogant/pypickle/releases/tag/2.0.0 release notes
• https://vuldb.com/?ctiid.310263 permissions required · vdb entry