Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/archivebox@0.6.0
Typepypi
Namespace
Namearchivebox
Version0.6.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.7.0
Latest_non_vulnerable_version0.7.0
Affected_by_vulnerabilities
0
url VCID-ghey-njvy-vqd1
vulnerability_id VCID-ghey-njvy-vqd1
summary ArchiveBox is an open source self-hosted web archiving system. Any users who are using the `wget` extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to target your ArchiveBox instance. Malicious Javascript could potentially act using your logged-in admin credentials and add/remove/modify snapshots, add/remove/modify ArchiveBox users, and generally do anything an admin user could do. The impact is less severe for non-logged-in users, as malicious Javascript cannot *modify* any archives, but it can still *read* all the other archived content by fetching the snapshot index and iterating through it. Because all of ArchiveBox's archived content is served from the same host and port as the admin panel, when archived pages are viewed the JS executes in the same context as all the other archived pages (and the admin panel), defeating most of the browser's usual CORS/CSRF security protections and leading to this issue. A patch is being developed in https://github.com/ArchiveBox/ArchiveBox/issues/239. As a mitigation for this issue would be to disable the wget extractor by setting `archivebox config --set SAVE_WGET=False`, ensure you are always logged out, or serve only a [static HTML version](https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archive#2-export-and-host-it-as-static-html) of your archive.
references
0
reference_url https://en.wikipedia.org/wiki/Cross-site_request_forgery
reference_id
reference_type
scores
url https://en.wikipedia.org/wiki/Cross-site_request_forgery
1
reference_url https://github.com/ArchiveBox/ArchiveBox
reference_id
reference_type
scores
url https://github.com/ArchiveBox/ArchiveBox
2
reference_url https://github.com/ArchiveBox/ArchiveBox#caveats
reference_id
reference_type
scores
url https://github.com/ArchiveBox/ArchiveBox#caveats
3
reference_url https://github.com/ArchiveBox/ArchiveBox/issues/239
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
url https://github.com/ArchiveBox/ArchiveBox/issues/239
4
reference_url https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-cr45-98w9-gwqx
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
url https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-cr45-98w9-gwqx
5
reference_url https://github.com/ArchiveBox/ArchiveBox/wiki/Configuration#save_wget
reference_id
reference_type
scores
url https://github.com/ArchiveBox/ArchiveBox/wiki/Configuration#save_wget
6
reference_url https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archive#2-export-and-host-it-as-static-html
reference_id
reference_type
scores
url https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archive#2-export-and-host-it-as-static-html
7
reference_url https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archive#security-concerns
reference_id
reference_type
scores
url https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archive#security-concerns
8
reference_url https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Overview
reference_id
reference_type
scores
url https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Overview
9
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/archivebox/PYSEC-2023-229.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/archivebox/PYSEC-2023-229.yaml
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-45815
reference_id CVE-2023-45815
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-45815
11
reference_url https://github.com/advisories/GHSA-cr45-98w9-gwqx
reference_id GHSA-cr45-98w9-gwqx
reference_type
scores
url https://github.com/advisories/GHSA-cr45-98w9-gwqx
fixed_packages
0
url pkg:pypi/archivebox@0.7.0
purl pkg:pypi/archivebox@0.7.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/archivebox@0.7.0
aliases CVE-2023-45815, GHSA-cr45-98w9-gwqx, PYSEC-2023-229
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ghey-njvy-vqd1
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/archivebox@0.6.0