PYSEC-2023-293 - An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to

Severity: low · CVSS 3.1 · Published 2023-12-13

Technologies: repox (PyPI). Vendors: PyPI.

Executive brief

An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any authentication method, resulting in the alteration or creation of users.

Affected products

PyPI repox

Related threats

PYSEC-2023-297 - A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resulting
PYSEC-2023-294 - An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable appli
PYSEC-2023-296 - An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the
PYSEC-2023-295 - An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on t