« Volver al listado

CVE-2018-3650

Estado: ModificadaAlta (7.8)—

Insufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 allows unprivileged user to bypass URI sanitization via local vector.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Intel — Distribution FOR Python

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-3650",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@intel.com",
      "affectedData": [
        {
          "vendor": "Intel Corporation",
          "product": "Intel Distribution for Python",
          "versions": [
            {
              "status": "affected",
              "version": "Before 2018 Update 2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-08-01T15:29:00.377",
  "references": [
    {
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00129.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00129.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 allows unprivileged user to bypass URI sanitization via local vector."
    },
    {
      "lang": "es",
      "value": "Validación de entradas insuficiente en el módulo Bleach en INTEL Distribution for Python en versiones anteriores a IDP 2018 Update 2 permite que usuarios sin privilegios omitan el saneamiento de URI mediante vectores locales."
    }
  ],
  "lastModified": "2026-06-17T01:57:37.810",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:intel:distribution_for_python:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88FE6956-8938-46E8-A309-350F9C89C9D4",
              "versionEndExcluding": "2018"
            },
            {
              "criteria": "cpe:2.3:a:intel:distribution_for_python:2018:update_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AA04071-33A8-4F30-926B-4389552B7313"
            },
            {
              "criteria": "cpe:2.3:a:intel:distribution_for_python:2018:update_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D76903A2-DCE4-4A44-BAC2-0C79D9FB5E61"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@intel.com"
}