CVE-2024-45601
published 2024-09-18CVE-2024-45601: Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.28%
19.7th percentile
Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served. Users are strongly advised to update to the latest version of Mesop immediately. The latest version includes a fix for this vulnerability. At time of publication 0.12.4 is the most recently available version of Mesop.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mesop | — | — | |
| mesop-dev | mesop | >= 0.9.0 < 0.12.4 | 0.12.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mesop has a local file Inclusion via static file serving functionality
osv·2024-09-18
CVE-2024-45601 [HIGH] Mesop has a local file Inclusion via static file serving functionality
Mesop has a local file Inclusion via static file serving functionality
A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served.
Users are strongly advised to update to the latest version of Mesop immediately. The latest version includes a fix for this vulnerability.
We would like to thank @Letm3through for reporting this issue and proposing mitigations to address this issue.
GHSA
Mesop has a local file Inclusion via static file serving functionality
ghsa·2024-09-18
CVE-2024-45601 [HIGH] CWE-20 Mesop has a local file Inclusion via static file serving functionality
Mesop has a local file Inclusion via static file serving functionality
A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validation in a specific endpoint. This could have allowed an attacker to access files not intended to be served.
Users are strongly advised to update to the latest version of Mesop immediately. The latest version includes a fix for this vulnerability.
We would like to thank @Letm3through for reporting this issue and proposing mitigations to address this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-09-18
Published