Maple Labs

CVE search · CVE-2017-2810

CVE-2017-2810

critical 9.8

An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
talos-cna@cisco.com
Weakness
NVD-CWE-noinfo

Severity

VersionScoreVectorSource
CVSS 3.0 high 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H talos-cna@cisco.comSecondary
CVSS 3.0 critical 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H nvd@nist.govPrimary
CVSS 2.0 high 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References