Description

It was determined that your web application is performing Python object deserialization (using the pickle library) of user-supplied data. Arbitrary object deserialization is inherently unsafe, and should never be performed on untrusted data. Consult Web references section for more information about this issue.

Remediation

The pickle module is not intended to be secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.

References

Exploiting Misuse of Python's "Pickle"

Related Vulnerabilities

WordPress Plugin WP Statistics SQL Injection (13.1.4)

WordPress Plugin WooCommerce Possible Remote Code Execution (3.4.5)

WordPress Plugin WordPress Clean Up & Optimizer-Clean Up Optimizer SQL Injection (3.0.13)

Unauthenticated remote code execution vulnerability in Confluence Server and Data Center

Prototype pollution

Severity

Medium

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Abuse Of Functionality Insecure Deserialization Denial Of Service Code Execution SQL Injection Code Execution Directory Traversal