pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
| Version | Score | Severity | Vector String |
|---|---|---|---|
| 4.0 | 4.1 | Medium | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| 3.1 | 8 | High | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| Product | Vendor | Version |
|---|---|---|
| pip | Python Packaging Authority | Prior to HPE Integrated Lights-Out 4 (iLO 4) version 2.78 |
| pip | Python Packaging Authority | < 87.0.4280.66 |