CVE-2018-8097

Description

io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter.

How to fix CVE-2018-8097

To remediate CVE-2018-8097, upgrade the affected package to a fixed version below.

• PyPI/eve—upgrade to 0.7.5 or later
• PyPI/eve—upgrade to f8f7019ffdf9b4e05faf95e1f04e204aa4c91f98 or later

Is CVE-2018-8097 being exploited?

Moderate — EPSS is 19.1%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (2)

• from 0, < 0.7.5
• from 0, < f8f7019ffdf9b4e05faf95e1f04e204aa4c91f98 | from 0, < 0.7.5

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-8jxq-75rw-fhj9
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-8097
• PATCHgithub.com/pyeve/eve
• WEBgithub.com/pyeve/eve/commit/f8f7019ffdf9b4e05faf95e1f04e204aa4c91f98
• WEB