What is GHSA-fr75-x856-q6j8?

GHSA-fr75-x856-q6j8 is a security advisory published by GitHub Security Advisories with Critical severity. Octobot mishandles Tentacles upload

Which CVE IDs does GHSA-fr75-x856-q6j8 cover?

GHSA-fr75-x856-q6j8 covers the following CVE IDs: CVE-2021-36711. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fr75-x856-q6j8?

GHSA-fr75-x856-q6j8 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-fr75-x856-q6j8?

GHSA-fr75-x856-q6j8 affects 1 product, including: pip/OctoBot:\u003c 0.4.4.

GHSA-fr75-x856-q6j8CriticalCVSS 9.8

Octobot mishandles Tentacles upload

Vendor

GitHub Security Advisories

Published

July 17, 2022

Last Modified

October 7, 2024

🔗 CVE IDs covered (1)

CVE-2021-36711 →

📋 Description

WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.

🎯 Affected products1

pip/OctoBot:< 0.4.4

🔗 References (10)

https://nvd.nist.gov/vuln/detail/CVE-2021-36711
https://github.com/Drakkar-Software/OctoBot/issues/1966
https://github.com/Drakkar-Software/OctoBot/blob/master/CHANGELOG.md
https://github.com/Nwqda/Sashimi-Evil-OctoBot-Tentacle
https://packetstormsecurity.com/files/167721/Sashimi-Evil-OctoBot-Tentacle.html
https://github.com/Drakkar-Software/OctoBot/blob/master/CHANGELOG.md#044---2022-06-01
https://github.com/pypa/advisory-database/tree/main/vulns/octobot/PYSEC-2022-235.yaml
http://packetstormsecurity.com/files/167780/OctoBot-WebInterface-0.4.3-Remote-Code-Execution.html
https://github.com/advisories/GHSA-fr75-x856-q6j8
https://www.octobot.online