CVE-2024-47532 HIGH

CVE-2024-47532: RestrictedPython information leakage via `AttributeError.obj` and the `string` module

Vendor Zopefoundation
Product RestrictedPython
Weakness CWE-200 · Info exposure
Published September 30, 2024
Last update September 30, 2024

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.

Key dates

02Disclosure timeline

September 30, 2024 CVE published
September 30, 2024 Record updated

Related vulnerabilities

04Related CVE