An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an __import__('os').popen('whoami').read() line. NOTE: the vendor's position is that the product is "vulnerable by design" and the current behavior will be retained
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-10-18T16:15:08

Updated: 2024-08-05T01:40:15.933Z

Reserved: 2019-10-12T00:00:00

Link: CVE-2019-17526

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-10-18T17:15:10.517

Modified: 2024-11-21T04:32:26.907

Link: CVE-2019-17526

cve-icon Redhat

No data.