What is CVE-2023-28627?

CVE-2023-28627 is a high-severity vulnerability in Pymedusa Medusa, classified under OS Command Injection. CVSS score: 8.3/10. Published 2023-03-27.

How severe is CVE-2023-28627?

High severity. CVSS v3 base score is 8.3 out of 10.

RCE in Pymedusa Medusa

CVE-2023-28627

pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.008 (53.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L.

Affected products

Pymedusa Medusa — versions < 1.0.12

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-28627?: CVE-2023-28627 is a high-severity vulnerability in Pymedusa Medusa, classified under OS Command Injection. CVSS score: 8.3/10. Published 2023-03-27.
How severe is CVE-2023-28627?: High severity. CVSS v3 base score is 8.3 out of 10.