Maple Labs

CVE search · CVE-2015-20107

CVE-2015-20107

high 7.6

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
cve@mitre.org
Weakness
CWE-77

Severity

VersionScoreVectorSource
CVSS 3.1 high 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L nvd@nist.govPrimary
CVSS 3.1 high 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary
CVSS 2.0 high 8.0 AV:N/AC:L/Au:S/C:P/I:C/A:P nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References