What is GHSA-73v2-rxqp-7q4f?

GHSA-73v2-rxqp-7q4f is a security advisory published by GitHub Security Advisories with High severity. aliyundrive-webdav vulnerable to Command Injection

Which CVE IDs does GHSA-73v2-rxqp-7q4f cover?

GHSA-73v2-rxqp-7q4f covers the following CVE IDs: CVE-2024-29640. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-73v2-rxqp-7q4f?

GHSA-73v2-rxqp-7q4f affects 2 products, including: rust/aliyundrive-webdav:\u003c= 2.3.3; pip/aliyundrive-webdav:\u003c= 2.3.3.

GHSA-73v2-rxqp-7q4fHigh

aliyundrive-webdav vulnerable to Command Injection

Vendor

GitHub Security Advisories

Published

March 29, 2024

Last Modified

March 29, 2024

🔗 CVE IDs covered (1)

CVE-2024-29640 →

📋 Description

An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component.

🎯 Affected products2

rust/aliyundrive-webdav:<= 2.3.3
pip/aliyundrive-webdav:<= 2.3.3

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2024-29640
https://github.com/lakemoon602/vuln/blob/main/detail.md
https://github.com/messense/aliyundrive-webdav
http://aliyundrive-webdav.com
https://github.com/messense/aliyundrive-webdav/blob/main/openwrt/luci-app-aliyundrive-webdav/luasrc/controller/aliyundrive-webdav.lua
https://github.com/advisories/GHSA-73v2-rxqp-7q4f