CVE-2024-47532 - CVE House

Back to Database

Status published High CVE-2024-47532

RestrictedPython information leakage via `AttributeError.obj` and the `string` module

8.7 CVSS

Vulnerability Description

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected (and potentially sensible) information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application does not require access to the module string, it can remove it from RestrictedPython.Utilities.utility_builtins or otherwise do not make it available in the restricted execution environment.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47532

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from zopefoundation

View All →

try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

User data deletion by anoynmous users in Zope

Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution

Zope management interface vulnerable to stored cross site scripting via the title property

Zope vulnerable to Stored Cross Site Scripting with SVG images

Affected Vendor

zopefoundation

View all reports →

Affected Software

RestrictedPython

Vulnerable Versions:

< 7.3

Timeline

Official Publish: September 30th, 2024

Last Modified: September 30th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel