PT-2024-16796
CVE-2024-11168
·
Published
2023-04-25
·
Updated
2026-04-02
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:N
Name of the Vulnerable Software and Affected Versions
Python urllib.parse module (affected versions not specified)
Description
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (
[]), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploitability
Exploit
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾