CVE-2024-21644
Pyload ≤ 0.4.9
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-21644 is a high-severity Improper Access Control (CWE-284) vulnerability in Pyload Pyload. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
pyLoad, the open-source Python download manager, contains an information disclosure vulnerability that allows exposure of the underlying Flask application configuration. Unauthenticated remote users can access a specific URL to retrieve the full Flask config, including the SECRET_KEY value, due to improper access controls tracked under CWE-284. The issue affects versions prior to the patch released in 0.5.0b3.dev77 and carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and high confidentiality impact.
An attacker with no credentials or user interaction can exploit the flaw simply by requesting the exposed endpoint, obtaining the SECRET_KEY and any other sensitive configuration data stored in the Flask environment. Possession of the key enables further attacks such as session forgery or tampering with application state, though the vulnerability itself is limited to read access on the config.
The official GitHub security advisory GHSA-mqpq-2p68-46fv and the referenced commit bb22063a875ffeca357aaf6e2edcd09705688c40 confirm the patch that restricts access to the configuration endpoint. Administrators are advised to upgrade to the fixed development build to prevent unauthenticated disclosure.
The EPSS score has remained steady at its peak value of 0.8928 with no indicated rise after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0387
Vulnerability Data
pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for logical access, stopping unauthorized actors from reaching resources.
Enforces flow-control policies that restrict information movement between subjects and objects.
Documents duties and assigns access so that no single account can bypass intended restrictions.
Limits each account to the minimum privileges needed, reducing the chance of unauthorized access.
Defines account types, assigns/removes access, and reviews accounts to ensure only authorized actors can reach resources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.1 only requires that an information security policy and topic-specific policies (including on access control) exist and are reviewed; it does not itself enforce, implement or act on any access restriction, so the weakness can still be exploited (per the owner's explicit rule that governance/dependency clauses score none on effect verbs).
A.5.15 directly mandates determining requirements, defining/implementing topic-specific access control policy+rules (with explicit references to 8.3, 5.16, 5.18), and enforcing authorized access while preventing unauthorized access, which squarely stops exploitation of most CWE-284 instances; the bounded remainder is the physical slice (explicitly delegated to 7.2-7.4) plus any second-order defects like path traversal that are not authorization decisions.
A.5.16's identity lifecycle (unique binding, timely disable/remove, no duplicates, oversight of shared/non-human) directly stops most improper access by ensuring the actor in an access decision is correctly identified and authorized; the bounded remainder is non-identity mechanisms in CWE-284 such as path traversal or CSRF that do not turn on actor identity at all.
A.5.18 directly governs the provisioning, review, adjustment and timely revocation of both physical and logical access rights per business rules, segregation of duties and risk-evaluated changes/terminations; this stops most unauthorized-actor exploitation paths named by CWE-284, with a bounded remainder (e.g. path-traversal or CSRF cases that are not authorization decisions at all)
A.5.2 defines and assigns roles/responsibilities for protection of information and risk acceptance; it does not itself enforce any access decision and cannot stop exploitation of improper access control (per the owner's labeling rule: governance/dependency clauses do not score on prevent/mitigate verbs)
Ongoing audits and performance reviews of suppliers detect and correct situations where access controls or privilege assignments are weaker than contractually required, limiting an attacker's ability to exploit improper access control in the supplier's environment.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.