rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the serializer: pickle HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rpc.py | Rpc.py_project | 0.4.2 (including) | 0.6.0 (including) |