PyAutoGUI-0.9.54.tar.gz: 1 vulnerabilities (highest severity is: 7.3)

[mend-bolt-for-github]

Vulnerable Library - PyAutoGUI-0.9.54.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: b2b2eb325dc81df00162fc7b87524324be1c6492

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (PyAutoGUI version)	Remediation Possible**
CVE-2024-25123	High	7.3	mss-7.0.1-py3-none-any.whl	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-25123

Vulnerable Library - mss-7.0.1-py3-none-any.whl

An ultra fast cross-platform multiple screenshots module in pure python using ctypes.

Library home page: https://files.pythonhosted.org/packages/b0/4c/99dcba4d3654b5e5498f99c800108202660ba9d216168dd7feb9dc8d6c90/mss-7.0.1-py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• PyAutoGUI-0.9.54.tar.gz (Root Library)
  • PyScreeze-0.1.29.tar.gz
    • pyscreenshot-3.1-py3-none-any.whl
      • ❌ mss-7.0.1-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b2b2eb325dc81df00162fc7b87524324be1c6492

Found in base branch: main

Vulnerability Details

MSS (Mission Support System) is an open source package designed for planning atmospheric research flights. In file: index.py, there is a method that is vulnerable to path manipulation attack. By modifying file paths, an attacker can acquire sensitive information from different resources. The filename variable is joined with other variables to form a file path in _file. However, filename is a route parameter that can capture path type values i.e. values including slashes (). So it is possible for an attacker to manipulate the file being read by assigning a value containing ../ to filename and so the attacker may be able to gain access to other files on the host filesystem. This issue has been addressed in MSS version 8.3.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-02-15

URL: CVE-2024-25123

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here