CVE-2023-34457

Description

MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a `<input type="file" ...>` inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. Version 1.3.0 contains a patch for this issue.

Reserved 2023-06-06 | Published 2023-07-05 | Updated 2024-10-24 | Assigner GitHub_M

Problem types

CWE-20: Improper Input Validation

Product status

>= 0.2.0, < 1.3.0
affected

References

github.com/...alSoup/security/advisories/GHSA-x456-3ccm-m6j4

github.com/...ommit/d57c4a269bba3b9a0c5bfa20292955b849006d9e

github.com/MechanicalSoup/MechanicalSoup/releases/tag/v1.3.0

security.netapp.com/advisory/ntap-20230803-0005/

cve.org (CVE-2023-34457)

nvd.nist.gov (CVE-2023-34457)

Download JSON