CVE-2021-32849CWE-78

Arbitrary command execution in Gerapy

High · published January 26, 2022

CVSS v3.1
8.8
EPSS
8%
Percentile
94.6
In the wild
Unconfirmed
What it is

Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07650 · 94.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2022-01-26T21:30Z
EPSS history
Timeline
  • 26 JAN 21:30Z
    Arbitrary command execution in Gerapy
    cvelistv5