IM
IronMonkey Threat Research

CVE-2023-24329 HIGH

Published: 2023-02-17 | Last Modified: 2025-11-03 | Status: Modified

Description

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Additional Descriptions (1)

Un problema en el componente urllib.parse de Python anterior a 3.11.4 permite a los atacantes eludir los métodos de listas de bloqueo proporcionando una URL que comienza con caracteres en blanco.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactHIGH
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en CWE-20
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-20

Affected Products

Vendor Product Version Update Type
python python * <built-in method update of dict object at 0x7fd340891600> Application
python python * <built-in method update of dict object at 0x7fd341be8480> Application
python python * <built-in method update of dict object at 0x7fd3415424c0> Application
python python * <built-in method update of dict object at 0x7fd341beb7c0> Application
python python * <built-in method update of dict object at 0x7fd3703e1940> Application
fedoraproject fedora 36 <built-in method update of dict object at 0x7fd341beac00> Operating System
fedoraproject fedora 37 <built-in method update of dict object at 0x7fd341be8040> Operating System
fedoraproject fedora 38 <built-in method update of dict object at 0x7fd3703e3800> Operating System
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd3703e19c0> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd3703e2d00> Application
netapp management_services_for_element_software - <built-in method update of dict object at 0x7fd3703e1640> Application
netapp management_services_for_netapp_hci - <built-in method update of dict object at 0x7fd37039b000> Application
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x7fd340893340> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
Yes cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

References