Vulnerabilities > CVE-2018-17175 - Unspecified vulnerability in Marshmallow Project Marshmallow

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

marshmallow-project

nessus

NVD

Published: 2018-09-18

Updated: 2024-11-21

Summary

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").

Vulnerable Configurations

Part	Description	Count
Application	Marshmallow_Project Marshmallow Project Marshmallow 0.1.0 Marshmallow Project Marshmallow 0.2.0 Marshmallow Project Marshmallow 0.2.1 Marshmallow Project Marshmallow 0.3.0 Marshmallow Project Marshmallow 0.3.1 Marshmallow Project Marshmallow 0.4.0 Marshmallow Project Marshmallow 0.4.1 Marshmallow Project Marshmallow 0.5.0 Marshmallow Project Marshmallow 0.5.1 Marshmallow Project Marshmallow 0.5.2 Marshmallow Project Marshmallow 0.5.3 Marshmallow Project Marshmallow 0.5.4 Marshmallow Project Marshmallow 0.5.5 Marshmallow Project Marshmallow 0.6.0 Marshmallow Project Marshmallow 0.7.0 Marshmallow Project Marshmallow 1.0.0 Marshmallow Project Marshmallow 1.0.0-A Marshmallow Project Marshmallow 1.0.1 Marshmallow Project Marshmallow 1.1.0 Marshmallow Project Marshmallow 1.2.0 Marshmallow Project Marshmallow 1.2.1 Marshmallow Project Marshmallow 1.2.2 Marshmallow Project Marshmallow 1.2.3 Marshmallow Project Marshmallow 1.2.4 Marshmallow Project Marshmallow 1.2.5 Marshmallow Project Marshmallow 1.2.6 Marshmallow Project Marshmallow 2.0.0 Marshmallow Project Marshmallow 2.0.0A1 Marshmallow Project Marshmallow 2.0.0B1 Marshmallow Project Marshmallow 2.0.0B2 Marshmallow Project Marshmallow 2.0.0B3 Marshmallow Project Marshmallow 2.0.0B4 Marshmallow Project Marshmallow 2.0.0B5 Marshmallow Project Marshmallow 2.0.0Rc1 Marshmallow Project Marshmallow 2.0.0Rc2 Marshmallow Project Marshmallow 2.1.0 Marshmallow Project Marshmallow 2.1.1 Marshmallow Project Marshmallow 2.1.2 Marshmallow Project Marshmallow 2.1.3 Marshmallow Project Marshmallow 2.2.0 Marshmallow Project Marshmallow 2.2.1 Marshmallow Project Marshmallow 2.3.0 Marshmallow Project Marshmallow 2.4.0 Marshmallow Project Marshmallow 2.4.1 Marshmallow Project Marshmallow 2.4.2 Marshmallow Project Marshmallow 2.5.0 Marshmallow Project Marshmallow 2.6.0 Marshmallow Project Marshmallow 2.6.1 Marshmallow Project Marshmallow 2.7.0 Marshmallow Project Marshmallow 2.7.1 Marshmallow Project Marshmallow 2.7.2 Marshmallow Project Marshmallow 2.7.3 Marshmallow Project Marshmallow 2.8.0 Marshmallow Project Marshmallow 2.9.0 Marshmallow Project Marshmallow 2.9.1 Marshmallow Project Marshmallow 2.10.0 Marshmallow Project Marshmallow 2.10.1 Marshmallow Project Marshmallow 2.10.2 Marshmallow Project Marshmallow 2.10.3 Marshmallow Project Marshmallow 2.10.4 Marshmallow Project Marshmallow 2.10.5 Marshmallow Project Marshmallow 2.11.0 Marshmallow Project Marshmallow 2.11.1 Marshmallow Project Marshmallow 2.12.0 Marshmallow Project Marshmallow 2.12.1 Marshmallow Project Marshmallow 2.12.2 Marshmallow Project Marshmallow 2.13.0 Marshmallow Project Marshmallow 2.13.1 Marshmallow Project Marshmallow 2.13.2 Marshmallow Project Marshmallow 2.13.3 Marshmallow Project Marshmallow 2.13.4 Marshmallow Project Marshmallow 2.13.5 Marshmallow Project Marshmallow 2.13.6 Marshmallow Project Marshmallow 2.14.0 Marshmallow Project Marshmallow 2.15.0 Marshmallow Project Marshmallow 3.0.0A1 Marshmallow Project Marshmallow 3.0.0B1 Marshmallow Project Marshmallow 3.0.0B2 Marshmallow Project Marshmallow 3.0.0B3 Marshmallow Project Marshmallow 3.0.0B4 Marshmallow Project Marshmallow 3.0.0B5 Marshmallow Project Marshmallow 3.0.0B6 Marshmallow Project Marshmallow 3.0.0B7 Marshmallow Project Marshmallow 3.0.0B8	84

Nessus

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-8B109A6DE0.NASL
description	Security fix for CVE-2018-17175 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2018-10-11
plugin id	118046
published	2018-10-11
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/118046
title	Fedora 27 : python-marshmallow (2018-8b109a6de0)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-9006B64E41.NASL
description	Security fix for CVE-2018-17175 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2019-01-03
plugin id	120614
published	2019-01-03
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120614
title	Fedora 29 : python-marshmallow (2018-9006b64e41)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-CC9ADC4808.NASL
description	Security fix for CVE-2018-17175 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2019-01-03
plugin id	120796
published	2019-01-03
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120796
title	Fedora 28 : python-marshmallow (2018-cc9adc4808)

Summary

Vulnerable Configurations

Nessus

References