CVE-2022-45908 - In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr

Back Back to CVE browser

CRITICAL

In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr

Published Nov 26, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.40%

Description

In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7275
Advisory
https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2022-002.md
ExploitPatchThird Party Advisory
https://github.com/PaddlePaddle/Paddle/commit/26c419ca386aeae3c461faf2b828d00b48e908eb
PatchThird Party Advisory
https://github.com/advisories/GHSA-83g7-8fch-p37m
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-45908

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7275		Advisory
https://github.com/PaddlePaddle/Paddle/blob/develop/security/advisory/pdsa-2022-002.md		ExploitPatchThird Party Advisory
https://github.com/PaddlePaddle/Paddle/commit/26c419ca386aeae3c461faf2b828d00b48e908eb		PatchThird Party Advisory
https://github.com/advisories/GHSA-83g7-8fch-p37m		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-45908