CVE-2024-21645
MEDIUM NUCLEIpyload < 0.5.0b3.dev77 - Unauthenticated Log Injection
Title source: llmExploitation Summary
CVE-2024-21645 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can be used to cover an attacker’s tracks or even to implicate another party in the commission of a malicious act. This vulnerability has been patched in version 0.5.0b3.dev77.
Nuclei Templates (1)
pyload - Log Injection
MEDIUMVERIFIEDby isacaya
Shodan:
title:"pyload" || http.title:"login - pyload" || http.html:"pyload" || http.title:"pyload"
FOFA:
title="login - pyload" || body="pyload" || title="pyload"
References (2)
Core 2
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://github.com/pyload/pyload/security/advisories/GHSA-ghmw-rwh8-6qmr
Patch x_refsource_misc
https://github.com/pyload/pyload/commit/4159a1191ec4fe6d927e57a9c4bb8f54e16c381d
Scores
CVSS v3
5.3
EPSS
0.2451
EPSS Percentile
97.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-74
Status
published
Products (3)
pyload/pyload
0.5.0 beta1 (2 CPE variants)
pyload/pyload
< 0.4.9
pypi/pyload-ng
0 - 0.5.0b3.dev77PyPI
Published
Jan 08, 2024
Tracked Since
Feb 18, 2026