CVE-2018-17175

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/marshmallow-code/marshmallow/issues/772Issue Tracking, Third Party Advisory
https://github.com/marshmallow-code/marshmallow/pull/777Third Party Advisory
https://github.com/marshmallow-code/marshmallow/pull/782Third Party Advisory
https://github.com/marshmallow-code/marshmallow/issues/772Issue Tracking, Third Party Advisory
https://github.com/marshmallow-code/marshmallow/pull/777Third Party Advisory
https://github.com/marshmallow-code/marshmallow/pull/782Third Party Advisory

Timeline

Published: Sep 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-171767.5A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but once recorded, the a CVE-2018-171772.4An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called CVE-2018-171785.3An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands (sent to /bin/webserver CVE-2018-171799.8An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/ta CVE-2018-17185.4IBM Sterling B2B Integrator Standard Edition 5.2.0.1 - 5.2.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to emb CVE-2018-171805.3An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php.CVE-2018-171819.8An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the po CVE-2018-171827.8An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number over CVE-2018-171837.8Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafte CVE-2018-171845.4A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names CVE-2018-171867.2An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, CVE-2018-171877.4The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Un