CVE-2022-30284

In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case
References
Link Resource
https://github.com/savon-noir/python-libnmap/releases Release Notes Third Party Advisory
https://libnmap.readthedocs.io/en/latest/process.html#using-libnmap-process Exploit Third Party Advisory
https://pypi.org/project/python-libnmap/ Product Third Party Advisory
https://www.swascan.com/security-advisory-libnmap-2/ Exploit Mitigation Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:python-libnmap_project:python-libnmap:*:*:*:*:*:python:*:*

History

07 Nov 2023, 03:47

Type Values Removed Values Added
Summary ** DISPUTED ** In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case. In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case

14 Dec 2022, 18:48

Type Values Removed Values Added
References (MISC) https://libnmap.readthedocs.io/en/latest/process.html#using-libnmap-process - (MISC) https://libnmap.readthedocs.io/en/latest/process.html#using-libnmap-process - Exploit, Third Party Advisory

02 Jun 2022, 14:15

Type Values Removed Values Added
Summary In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). ** DISPUTED ** In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case.
References
  • (MISC) https://libnmap.readthedocs.io/en/latest/process.html#using-libnmap-process -

13 May 2022, 18:25

Type Values Removed Values Added
CPE cpe:2.3:a:python-libnmap_project:python-libnmap:*:*:*:*:*:python:*:*
References (MISC) https://github.com/savon-noir/python-libnmap/releases - (MISC) https://github.com/savon-noir/python-libnmap/releases - Release Notes, Third Party Advisory
References (MISC) https://pypi.org/project/python-libnmap/ - (MISC) https://pypi.org/project/python-libnmap/ - Product, Third Party Advisory
References (MISC) https://www.swascan.com/security-advisory-libnmap-2/ - (MISC) https://www.swascan.com/security-advisory-libnmap-2/ - Exploit, Mitigation, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 7.5
v3 : 9.8
CWE CWE-88
First Time Python-libnmap Project python-libnmap
Python-libnmap Project

04 May 2022, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-05-04 22:15

Updated : 2024-03-21 02:42


NVD link : CVE-2022-30284

Mitre link : CVE-2022-30284

CVE.ORG link : CVE-2022-30284


JSON object : View

Products Affected

python-libnmap_project

  • python-libnmap
CWE
CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')