Server-Side Request Forgery in unoconv · CVE-2019-17400 · GitHub Advisory Database · GitHub

Server-Side Request Forgery in unoconv

High severity GitHub Reviewed Published Oct 24, 2019 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

unoconv (pip)

Affected versions

< 0.9.0

Patched versions

0.9.0

Description

The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.

References

Published by the National Vulnerability Database

Oct 21, 2019

Reviewed Oct 24, 2019

Published to the GitHub Advisory Database Oct 24, 2019

Last updated Feb 1, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N