pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.

pyLoad version prior to 0.5.0b3.dev76 is affected by an Improper Access Control vulnerability. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. An attacker can leverage this vulnerability to perform further attacks against the application.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can
    browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has
    been patched in version 0.5.0b3.dev77. (CVE-2024-21644)

ID	Name	Product	Family	Severity
114978	pyLoad < 0.5.0b3.dev76 Improper Access Control	Web App Scanning	Component Vulnerability	high
417097	SCA: security update for pyload-ng (GHSA-mqpq-2p68-46fv)	Tenable Cloud Security	SCA Checks	high
417097	SCA: security update for pyload-ng (GHSA-mqpq-2p68-46fv)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2024-21644

high

Tenable Plugins

high

high

high