CVE-2023-24329High· 7.5▾ MidnightPoC availableAn issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 4.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
20%
4 GitHub repos (last check)
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
python < 3.7.17python >= 3.8.0, < 3.8.17python >= 3.9.0, < 3.9.17python >= 3.10.0, < 3.10.12python >= 3.11.0, < 3.11.4fedora = 36fedora = 37fedora = 38active_iq_unified_managermanagement_services_for_element_softwaremanagement_services_for_netapp_hciontap_select_deploy_administration_utilityUpgrade past the affected range:
python 3.11.4Connected by shared product, vendor, weakness, or advisory.
CVE-2022-48560High· 7.5A use-after-free exists in Python through 3.9 via heappushpop in heapq.
CVE-2022-0391High· 7.5A flaw was found in Python, specifically within the urllib.parse module
CVE-2021-23336Medium· 5.9The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by usi…
CVE-2015-20107High· 7.6In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file
CVE-2022-45061High· 7.5An issue was discovered in Python before 3.11.1
CVE-2021-28861High· 7.4Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure