CRITICALCVSS 9.8EPSS 1.1%

CVE-2024-3955

CraftBeerPi 4 allows arbitrary code execution

Published: 2024-05-02
Modified: 2026-10-27
EPSS percentile: 67%
Aliases: GHSA-4f92-w438-f484
Sources: github-advisory

Summary

URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system_controller.py" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	cbpi4	—	4.4.1.a1

Remediation: Upgrade to 4.4.1.a1 or later.

References

https://github.com/advisories/GHSA-4f92-w438-f484

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.