CVE-2024-9287 Vulnerability Details

  /     /     /  

CVE-2024-9287 Metadata Quick Info

CVE Published: 22/10/2024 | CVE Updated: 03/12/2024 | CVE Year: 2024
Source: PSF | Vendor: Python Software Foundation | Product: CPython
Status : PUBLISHED

---

CVE-2024-9287 Description

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren\'t activated before being used (ie "./venv/bin/python") are not affected.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-428
CWE Name: CWE-428 Unquoted Search Path or Element
Source: Python Software Foundation

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).