CVE-2024-53992

CVSS V2 None CVSS V3 None

Description

unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This vulnerability is fixed in 7.0.3a.

Overview

CVE ID
CVE-2024-53992

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-12-02T17:03:22.631Z

Last Modified Date
2024-12-02T17:03:22.631Z

Weakness Enumerations

CWE	URL
CWE-78	http://cwe.mitre.org/data/definitions/78.html

References

Reference URL	Reference Tags
https://github.com/EDM115/unzip-bot/security/advisories/GHSA-34cg-7f8c-fm5h	x_refsource_CONFIRM
https://github.com/EDM115/unzip-bot/commit/5213b693eabb562842cdbf21c1074e91bfa00274	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-53992
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53992

History

Created	Old Value	New Value	Data Type	Notes
2024-12-03 13:40:17				Added to TrackCVE