Insecure Defaults Affecting khoros package, versions [,3.5.0)
Snyk CVSS
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-KHOROS-1090199
- published 1 Apr 2021
- disclosed 1 Apr 2021
- credit Unknown
How to fix?
Upgrade khoros to version 3.5.0 or higher.
Overview
khoros is an Useful tools and utilities to assist in managing a Khoros Community (formerly Lithium) environment.
Affected versions of this package are vulnerable to Insecure Defaults. An issue exists where the default value for the shell parameter to be False within py:func:khoros.utils.core_utils.run_cmd function. This is considered dangerous if user input flows into the run_cmd function.