CVE-2018-8097 Eve allows execution of arbitrary code
CriticalCVSS 9.8
EPSS 6.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi eve(PyPI) | < 0.7.5 | 0.7.5 |
| pypi eve(PyPI) | = 0.0.1 | No fix listed |
| pypi eve(PyPI) | = 0.0.2 | No fix listed |
| pypi eve(PyPI) | = 0.0.3 | No fix listed |
| pypi eve(PyPI) | = 0.0.4 | No fix listed |
| pypi eve(PyPI) | = 0.0.5 | No fix listed |
| pypi eve(PyPI) | = 0.0.6 | No fix listed |
| pypi eve(PyPI) | = 0.0.7 | No fix listed |
| pypi eve(PyPI) | = 0.0.8 | No fix listed |
| pypi eve(PyPI) | = 0.0.9 | No fix listed |
| pypi eve(PyPI) | = 0.1 | No fix listed |
| pypi eve(PyPI) | = 0.1.1 | No fix listed |
| pypi eve(PyPI) | = 0.2 | No fix listed |
| pypi eve(PyPI) | = 0.3 | No fix listed |
| pypi eve(PyPI) | = 0.4 | No fix listed |
| pypi eve(PyPI) | = 0.5 | No fix listed |
| pypi eve(PyPI) | = 0.5.1 | No fix listed |
| pypi eve(PyPI) | = 0.5.2 | No fix listed |
| pypi eve(PyPI) | = 0.5.3 | No fix listed |
| pypi eve(PyPI) | = 0.6 | No fix listed |
| pypi eve(PyPI) | = 0.6.1 | No fix listed |
| pypi eve(PyPI) | = 0.6.2 | No fix listed |
| pypi eve(PyPI) | = 0.6.3 | No fix listed |
| pypi eve(PyPI) | = 0.6.4 | No fix listed |
| pypi eve(PyPI) | = 0.7 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi eve(PyPI) | = 0.7.1 | No fix listed |
| pypi eve(PyPI) | = 0.7.2 | No fix listed |
| pypi eve(PyPI) | = 0.7.3 | No fix listed |
| pypi eve(PyPI) | = 0.7.4 | No fix listed |
| python-eve eve | < 0.7.5 | 0.7.5 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking third-party-advisory
- github.com patch third-party-advisory
- github.com vendor-advisory
- github.com product
- github.com