Description (CNA)
Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Arelle / Arelle | affected 0 before 2.39.10 |
CWE
CWE-306
References
- https://github.com/Arelle/Arelle/releases/tag/2.39.10
- https://github.com/Arelle/Arelle/pull/2320
- https://www.vulncheck.com/advisories/arelle-unauthenticated-rce-via-rest-configure
ADP enrichment
No English description supplied.
No references supplied.