CVE-2024-1682— Unclaimed S3 Bucket Reference in psf/requests Documentation
Quick assessment
Affected
psf psf/requests
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Requests是Python基金会的一个优雅而简单的HTTP库。通过请求，您可以非常轻松地发送HTTP / 1.1请求。无需将查询字符串手动添加到您的URL，也无需对POST数据进行表单编码。 Requests存在安全漏洞，该漏洞源于在.rst留档文件中引用了未认领的Amazon S3存储桶codconf，会导致数据完整性问题、数据泄露等问题。
Possible ATT&CK Techniques 2 AI
T1535 · Unused/Unsupported Cloud Regions T1567 · Exfiltration Over Web Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-1682
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unclaimed S3 Bucket Reference in psf/requests Documentation
Source: CVE Program / CVE List V5
Vulnerability Description
An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of trustworthiness, and potential further attacks if the bucket is used to host malicious content or as a pivot point for further attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
业务逻辑错误
Source: CVE Program / CVE List V5
Vulnerability Title
Requests 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Requests是Python基金会的一个优雅而简单的HTTP库。通过请求，您可以非常轻松地发送HTTP / 1.1请求。无需将查询字符串手动添加到您的URL，也无需对POST数据进行表单编码。 Requests存在安全漏洞，该漏洞源于在.rst留档文件中引用了未认领的Amazon S3存储桶codconf，会导致数据完整性问题、数据泄露等问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| psf | psf/requests | unspecified ~ N/A | - |
|
II. Public POCs for CVE-2024-1682
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-1682
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: psf
-
CVE-2026-25645
Requests has Insecure Temp File Reuse in its extract_zipped_ -
CVE-2026-32274
Black: Arbitrary file writes from unsanitized user input in -
CVE-2026-31900
Black's vulnerable version parsing leads to RCE in GitHub Ac -
CVE-2024-47081
Requests vulnerable to .netrc credentials leak via malicious -
CVE-2024-35195
Requests `Session` object does not verify requests after mak
Same weakness: CWE-840
-
CVE-2026-109406
macrozheng mall mall-portal generateOrder OmsPortalOrderServ -
CVE-2026-108784
macrozheng mall Payment Endpoint AlipayServiceImpl.java Alip -
CVE-2026-105573
newbee-ltd newbee-mall Shopping Cart Quantity updateAccountH -
CVE-2026-77166
Emoji更新端点布局破坏漏洞 -
CVE-2026-82982
Approval应用ETag缺失致审批校验绕过
V. Comments for CVE-2024-1682
No comments yet