CVE-2018-17175
mediumPriorität · verfolgen · 22EPSS 0.019 · 80. PerzentilEUUSEPSS · bewertet 2026-10-27
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (5)
Betroffene Produkte und Versionsbereiche.
- marshmallow project marshmallow< 2.15.1nvdUScpe:2.3:a:marshmallow_project:marshmallow:*:*:*:*:*:*:*:*
- marshmallow project marshmallow3.0 → 3.0.0b9nvdUScpe:2.3:a:marshmallow_project:marshmallow:*:*:*:*:*:*:*:*
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-9q2p-fj49-vpxjIn marshmallow library the schema "only" option treats an empty list as implying no "only" option2018-10-10ghsa · osvUS
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
- PYSEC-2018-672018-09-18vendor · osvUS
In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (9)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/marshmallow-code/marshmallow/issues/772cnnvd
- https://github.com/marshmallow-code/marshmallow/pull/777cnnvd
- https://github.com/marshmallow-code/marshmallow/pull/782cnnvd
- https://github.com/marshmallow-code/marshmallow/issues/772enisa_euvd
- https://github.com/marshmallow-code/marshmallow/pull/777enisa_euvd
- https://github.com/marshmallow-code/marshmallow/pull/782enisa_euvd
- https://github.com/marshmallow-code/marshmallow/issues/772Issue TrackingThird Party Advisorynvd
- https://github.com/marshmallow-code/marshmallow/pull/777Third Party Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan