Withdrawn Advisory: Mobile Security Framework (MobSF) Vulnerable to Insecure Permissions

高 7.5CVE-2023-42261 · GHSA-cc8j-6phr-jv9x · PYSEC-2023-310 · 21/09/2023 公開 · 17/06/2026 更新

要点

CVE-2023-42261 は mobsf, mobile security framework (opensecurity) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.86%（全脆弱性の 58.5% より高い）。
対処：3.9.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
mobsf PyPI	`< 3.9.7`	`3.9.7`
mobile security framework opensecurity	`= 3.7.8≤ 3.7.6`	修正版なし

概要

Withdrawn Advisory

This advisory has been withdrawn because the vendor's position is that authentication is intentionally not implemented because the product is not intended for an untrusted network environment. Use cases requiring authentication could, for example, use a reverse proxy server.

Original Description

Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions.

NVD の説明

Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is that authentication is intentionally not implemented because the product is not intended for an untrusted network environment. Use cases requiring authentication could, for example, use a reverse proxy server.