CVE-2024-1682: psf psf/requests Business Logic Errors

Vulnerability summary

CVE-2024-1682 is a medium (CVSS 4.3) Business Logic Errors vulnerability in psf psf/requests. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.9% of scored vulnerabilities.

Timeline

1. 14-11-2024
   PublishedVulnerability first disclosed.
2. 18-11-2024
   Last modifiedVulnerability information updated.

Description

An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of trustworthiness, and potential further attacks if the bucket is used to host malicious content or as a pivot point for further attacks.

• CWE-840Business Logic ErrorsWeaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.