Search criteria
3 vulnerabilities found for rootinteractive by pypi
FKIE_CVE-2022-32997
Vulnerability from fkie_nvd - Published: 2022-06-24 21:15 - Updated: 2024-11-21 07:07
Severity
Summary
The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | http://pypi.doubanio.com/simple/request | Product | |
| cve@mitre.org | https://github.com/miranov25/RootInteractive/issues/206 | Exploit, Issue Tracking, Third Party Advisory | |
| cve@mitre.org | https://pypi.org/project/RootInteractive/ | Product | |
| af854a3a-2127-422b-91ae-364da2661108 | http://pypi.doubanio.com/simple/request | Product | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/miranov25/RootInteractive/issues/206 | Exploit, Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://pypi.org/project/RootInteractive/ | Product |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| pypi | rootinteractive | * | |
| pypi | rootinteractive | 0.0.19 | |
| pypi | rootinteractive | 0.0.19 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pypi:rootinteractive:*:*:*:*:*:pypi:*:*",
"matchCriteriaId": "EEC1F7C4-783E-44A8-9F28-DF68E8C76AAA",
"versionEndExcluding": "0.0.19",
"versionStartIncluding": "0.0.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pypi:rootinteractive:0.0.19:-:*:*:*:pypi:*:*",
"matchCriteriaId": "FA9510C5-B80E-45C7-BB51-F93C250F037C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pypi:rootinteractive:0.0.19:b0:*:*:*:pypi:*:*",
"matchCriteriaId": "EC16346E-CFBF-4DFF-A204-967E053F3C2D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges."
},
{
"lang": "es",
"value": "Se ha detectado que el paquete RootInteractive en PyPI versiones v0.0.5 hasta v0.0.19b0, contiene una puerta trasera de ejecuci\u00f3n de c\u00f3digo por medio del paquete de petici\u00f3n. Esta vulnerabilidad permite a atacantes acceder a informaci\u00f3n confidencial del usuario y a claves de moneda digital, as\u00ed como escalar privilegios"
}
],
"id": "CVE-2022-32997",
"lastModified": "2024-11-21T07:07:23.253",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-24T21:15:08.010",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://pypi.doubanio.com/simple/request"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/miranov25/RootInteractive/issues/206"
},
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "https://pypi.org/project/RootInteractive/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://pypi.doubanio.com/simple/request"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/miranov25/RootInteractive/issues/206"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "https://pypi.org/project/RootInteractive/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2022-32997 (GCVE-0-2022-32997)
Vulnerability from cvelistv5 – Published: 2022-06-24 20:39 – Updated: 2024-08-03 07:54
VLAI
Summary
The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://pypi.doubanio.com/simple/request | x_refsource_MISC |
| https://pypi.org/project/RootInteractive/ | x_refsource_MISC |
| https://github.com/miranov25/RootInteractive/issues/206 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:54:03.456Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://pypi.doubanio.com/simple/request"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pypi.org/project/RootInteractive/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/miranov25/RootInteractive/issues/206"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T20:39:39.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://pypi.doubanio.com/simple/request"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pypi.org/project/RootInteractive/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/miranov25/RootInteractive/issues/206"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-32997",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://pypi.doubanio.com/simple/request",
"refsource": "MISC",
"url": "http://pypi.doubanio.com/simple/request"
},
{
"name": "https://pypi.org/project/RootInteractive/",
"refsource": "MISC",
"url": "https://pypi.org/project/RootInteractive/"
},
{
"name": "https://github.com/miranov25/RootInteractive/issues/206",
"refsource": "MISC",
"url": "https://github.com/miranov25/RootInteractive/issues/206"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-32997",
"datePublished": "2022-06-24T20:39:39.000Z",
"dateReserved": "2022-06-13T00:00:00.000Z",
"dateUpdated": "2024-08-03T07:54:03.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-32997 (GCVE-0-2022-32997)
Vulnerability from nvd – Published: 2022-06-24 20:39 – Updated: 2024-08-03 07:54
VLAI
Summary
The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://pypi.doubanio.com/simple/request | x_refsource_MISC |
| https://pypi.org/project/RootInteractive/ | x_refsource_MISC |
| https://github.com/miranov25/RootInteractive/issues/206 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:54:03.456Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://pypi.doubanio.com/simple/request"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pypi.org/project/RootInteractive/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/miranov25/RootInteractive/issues/206"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T20:39:39.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://pypi.doubanio.com/simple/request"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://pypi.org/project/RootInteractive/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/miranov25/RootInteractive/issues/206"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-32997",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://pypi.doubanio.com/simple/request",
"refsource": "MISC",
"url": "http://pypi.doubanio.com/simple/request"
},
{
"name": "https://pypi.org/project/RootInteractive/",
"refsource": "MISC",
"url": "https://pypi.org/project/RootInteractive/"
},
{
"name": "https://github.com/miranov25/RootInteractive/issues/206",
"refsource": "MISC",
"url": "https://github.com/miranov25/RootInteractive/issues/206"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-32997",
"datePublished": "2022-06-24T20:39:39.000Z",
"dateReserved": "2022-06-13T00:00:00.000Z",
"dateUpdated": "2024-08-03T07:54:03.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}