CVE-2020-28468

Improper Control of Generation of Code ('Code Injection')

High · published January 8, 2021

CVSS v3.1
8.1
EPSS
4%
Percentile
91.2
In the wild
Unconfirmed
What it is

This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CVSS v4.0
Not supplied
EPSS
0.04379 · 91.2th percentile
Published
2021-01-08T11:20Z
EPSS history
Timeline
  • 08 JAN 11:20Z
    Improper Control of Generation of Code ('Code Injection')
    cvelistv5