CVE-2023-1000

MEDIUM

dcnnt-py < 0.9.1 - Remote Command Injection in Notification Handler

Title source: llm
STIX 2.1

Description

A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is identified as b4021d784a97e25151a5353aa763a741e9a148f5. It is recommended to upgrade the affected component. VDB-262230 is the identifier assigned to this vulnerability.

References (5)

Core 5
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.262230
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.262230
Issue Tracking issue-tracking
https://github.com/cyanomiko/dcnnt-py/pull/23

Scores

CVSS v3 6.3
EPSS 0.0082
EPSS Percentile 74.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-77
Status published
Products (10)
cyanomiko/dcnnt-py 0.1
cyanomiko/dcnnt-py 0.2
cyanomiko/dcnnt-py 0.3
cyanomiko/dcnnt-py 0.4
cyanomiko/dcnnt-py 0.5
cyanomiko/dcnnt-py 0.6
cyanomiko/dcnnt-py 0.7
cyanomiko/dcnnt-py 0.8
cyanomiko/dcnnt-py 0.9
pypi/dcnnt 0 - 0.9.1PyPI
Published Apr 27, 2024
Tracked Since Feb 18, 2026