Vulnerability DatabaseCVE-2023-50447
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2023-50447
January 19, 2024
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
Affected Packages
pillow (PYTHON):
Affected version(s) >=1.0 <10.2.0
Fix Suggestion:
Update to version 10.2.0
Related Resources (12)
https://devhub.checkmarx.com/cve-details/CVE-2023-50447
https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html#security
https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/
https://devhub.checkmarx.com/cve-details/CVE-2023-50447/
https://duartecsantos.github.io/2023-01-02-CVE-2023-50447
https://github.com/python-pillow/Pillow/commit/45c726fd4daa63236a8f3653530f297dc87b160a
https://nvd.nist.gov/vuln/detail/CVE-2023-50447
https://github.com/python-pillow/Pillow/releases
http://www.openwall.com/lists/oss-security/2024/01/20/1
https://duartecsantos.github.io/2024-01-02-CVE-2023-50447
https://lists.debian.org/debian-lts-announce/2024/01/msg00019.html
https://github.com/python-pillow/Pillow
Do you need more information?
Contact Us
CVSS v4
Base Score:
9.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.1
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-95
Improper Control of Generation of Code ('Code Injection')
CWE-94
EPSS
Base Score:
0.75