Description
pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.
Exploits (2)
nomisec
WORKING POC
by mindstorm38 · poc
https://github.com/mindstorm38/ensimag-secu3a-cve-2024-22416
Scores
CVSS v3
9.6
EPSS
0.0590
EPSS Percentile
90.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lab Environment
Details
CWE
CWE-352
Status
published
Products (2)
pyload-ng_project/pyload-ng
< 0.5.0b3.dev78
pypi/pyload-ng
0 - 0.5.0b3.dev78PyPI
Published
Jan 18, 2024
Tracked Since
Feb 18, 2026