« Volver al listado

CVE-2011-4103

Estado: ModificadaAlta (7.5)—

emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Djangoproject — Piston

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-4103",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-10-27T01:55:23.280",
  "references": [
    {
      "url": "http://www.debian.org/security/2011/dsa-2344",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/11/01/10",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bitbucket.org/jespern/django-piston/commits/91bdaec89543/",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750658",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.debian.org/security/2011/dsa-2344",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2011/11/01/10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bitbucket.org/jespern/django-piston/commits/91bdaec89543/",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750658",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.djangoproject.com/weblog/2011/nov/01/piston-and-tastypie-security-releases/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method."
    },
    {
      "lang": "es",
      "value": "emitters.py en Django Piston anterior a 0.2.3 y 0.2.x anterior a 0.2.2.1 no deserializa debidamente los datos YAML, lo que permite a atacantes remotos ejecutar código Python arbitrario a través de vectores relacionados con el método yaml.load."
    }
  ],
  "lastModified": "2026-06-16T23:34:25.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:djangoproject:piston:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C10E7821-14C4-4A1E-98FD-2C7991937C98",
              "versionEndIncluding": "0.2.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}