CVE-2022-31313 describes a critical code execution backdoor found in version 0.1 of the api-res-py package on PyPI, specifically within its request package. This vulnerability carries a CVSS score of 9.8 (CRITICAL), indicating it can be exploited remotely without user interaction to achieve complete compromise of confidentiality, integrity, and availability. While not currently listed on the KEV catalog, the vulnerability has garnered significant community discussion and media coverage, including reports of it being a password stealer, suggesting a high potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.1CPE matchmatch criteria | cpe:2.3:a:api-res-py_project:api-res-py:0.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.