CVE-2006-0707 PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the....
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH_INFO variable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pyblosxom | <= 1.3.1 | No fix listed |
| pyblosxom | = 1.2.1 | No fix listed |
| pyblosxom | = 1.3 | No fix listed |
| debian/pyblosxom(Debian:10) | < 1.3.2-1 | 1.3.2-1 |
References
- 18858 patch third-party-advisory vendor-advisory
- sourceforge.net patch
- 16641 vdb-entry
- ADV-2006-0571 vdb-entry vendor-advisory
- pyblosxom-pathinfo-information-disclosure(24730) vdb-entry