PT-2024-28373

CVE-2024-39163

Published

2024-12-04

Updated

2026-07-07

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions binux pyspider versions up to 0.3.10

Description The issue is a Cross-Site Request Forgery (CSRF) that affects the Flask endpoints. This allows for unauthorized requests to be made on behalf of the user.

Recommendations For versions up to 0.3.10, as a temporary workaround, consider restricting access to the Flask endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Yaniv Nizry

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers

CVE-2024-39163

GHSA-PQJ8-XHCX-PRXM