What is GHSA-q5h6-49gg-2wfg?

GHSA-q5h6-49gg-2wfg is a security advisory published by GitHub Security Advisories with High severity. GramAddict bot uses dependency with reverse tcp backdoor

Which CVE IDs does GHSA-q5h6-49gg-2wfg cover?

GHSA-q5h6-49gg-2wfg covers the following CVE IDs: CVE-2020-36245. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q5h6-49gg-2wfg?

GHSA-q5h6-49gg-2wfg has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-q5h6-49gg-2wfg?

GHSA-q5h6-49gg-2wfg affects 1 product, including: pip/GramAddict:\u003c 1.2.5.

GHSA-q5h6-49gg-2wfgHighCVSS 8.8

GramAddict bot uses dependency with reverse tcp backdoor

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

September 20, 2024

🔗 CVE IDs covered (1)

CVE-2020-36245 →

📋 Description

GramAddict before 1.2.5 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

🎯 Affected products1

pip/GramAddict:< 1.2.5

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2020-36245
https://github.com/GramAddict/bot/issues/134
https://github.com/GramAddict/bot/pull/183
https://github.com/GramAddict/bot/commit/b9d11691b2fb13749c3cd0f75c70ee31242053ce
https://github.com/pypa/advisory-database/tree/main/vulns/gramaddict/PYSEC-2021-65.yaml
https://github.com/advisories/GHSA-q5h6-49gg-2wfg