CVE-2023-33733 is a high-severity arbitrary code execution vulnerability affecting ReportLab versions up to 3.6.12, allowing attackers to execute malicious code by providing a specially crafted PDF file. This vulnerability has a CVSS score of 7.8, indicating a high impact with complete compromise of confidentiality, integrity, and availability, and requires user interaction (UI:R) for exploitation. While not listed in CISA's KEV catalog, an exploit has been publicly released, and it has garnered significant community discussion and media coverage, including an article from BleepingComputer.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.6.12CPE matchmatch criteria | cpe:2.3:a:reportlab:reportlab:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.