CVE-2017-16618

Published Nov 8, 2017

Last updated 5 years ago

CVSS critical 9.8

Overview

Description: An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.0

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B0A7378E-9FA2-45B9-96ED-E62ABAA06163",
            "versionEndExcluding": "2.0.0"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8D100D4D-0C94-469E-8C68-A97C56078BE4"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha10:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E7020E5D-7F7D-4EFB-A0EB-7CC04E5226FC"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha11:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "383F3284-EA54-48FF-83E5-25F64E0D175E"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3CF06035-79B8-4E6F-B13F-0B818E031A46"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D0DFF14D-9FDA-4D7F-ACE8-767CCB123AC2"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3CDA9CE6-B074-46EF-BD50-EC1E2F742210"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9BBA654D-41BE-4388-8F51-C12750D65400"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "981BC8E3-0144-4A11-B140-894EFCA99AF4"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AAA28E1D-9B21-4DE1-8CC6-D6D0D3E14700"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha8:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A2EC30F7-1C22-4E5C-8441-2780591293B1"
          },
          {
            "criteria": "cpe:2.3:a:owlmixin_project:owlmixin:2.0.0:alpha9:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "706DCA46-9503-4ECB-A334-17CBF0FF22E3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.0

CVSS 2.0

Weaknesses

Social media

Configurations

References