// impact
Anyone publicly hosting the Apprise library and granting them access to the IFTTT notification service.
// patchesUpdate to Apprise v0.9.5.1
# Install Apprise v0.9.5.1 from PyPI pip install apprise==0.9.5.1
The patch to the problem was performed here.
// workaroundsAlternatively, if upgrading is not an option, you can safely remove the following file:
- apprise/plugins/NotifyIFTTT.py
The above will eliminate the ability to use IFTTT, but everything else will work smoothly.
// for more informationIf you have any questions or comments about this advisory:
- Open an issue in Apprise
- Email me at [lead2gold@gmail.com](mailto:lead2gold@gmail.com)
Github would not allow me to additionally credit Rasmus Petersen, but I would like to put that here at the very least - thank you for finding and reporting this issue along with those already credited
// additional notes:- Github would not allow me to add/tag the 2 CWE's this issue is applicable to (only CWE-400). The other is: CWE-730 (placed in the title)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High