GHSA-vx77-5pf4-c9wr

CherryPy Directory traversal vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2006-0847

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	cherrypy	< 2.1.1	2.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2006-0847 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/24809 web
https://github.com/cherrypy/cherrypy package
https://github.com/pypa/advisory-database/tree/main/vulns/cherrypy/PYSEC-2006-1.yaml web
https://web.archive.org/web/20140724140216/http://secunia.com/advisories/18944 web
https://web.archive.org/web/20140803230356/http://secunia.com/advisories/20344 web
https://web.archive.org/web/20200302050730/http://www.securityfocus.com/bid/16760 web
http://groups.google.com/group/cherrypy-announce/browse_thread/thread/92b2972f774fe6df/2f63afc9433dc306#2f63afc9433dc306 web
http://sourceforge.net/project/shownotes.php?release_id=384316&group_id=56099 web
http://www.cherrypy.org web
http://www.gentoo.org/security/en/glsa/glsa-200605-16.xml web