CVE-2008-0252 CherryPy Malicious cookies allow access to files outside the session directory
HighCVSS 7.5
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi cherrypy(PyPI) | < 2.1.1 | 2.1.1 |
| pypi cherrypy(PyPI) | = 0.10 | No fix listed |
| pypi cherrypy(PyPI) | = 2.0.0-final | No fix listed |
| pypi cherrypy(PyPI) | = 2.0.0b | No fix listed |
| pypi cherrypy(PyPI) | = 2.1.0 | No fix listed |
| pypi cherrypy(PyPI) | = 2.1.0-beta | No fix listed |
| pypi cherrypy(PyPI) | >= 3.0, < 3.0.2 | 3.0.2 |
| pypi cherrypy(PyPI) | = 3.0.0 | No fix listed |
| pypi cherrypy(PyPI) | = 3.0.1 | No fix listed |
| cherrypy | <= 2.1.0 | No fix listed |
| cherrypy | <= 3.0.2 | No fix listed |
| debian/cherrypy3(Debian:12) | < 3.0.2-2 | 3.0.2-2 |
| debian/cherrypy3(Debian:13) | < 3.0.2-2 | 3.0.2-2 |
| debian/cherrypy3(Debian:14) | < 3.0.2-2 | 3.0.2-2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugs.gentoo.org
- github.com product
- github.com
- issues.rpath.com
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- FEDORA-2008-0299 vendor-advisory
- FEDORA-2008-0333 vendor-advisory
- GLSA-200801-11 vendor-advisory
- www.cherrypy.org exploit patch
- www.cherrypy.org exploit patch
- www.cherrypy.org exploit
- www.cherrypy.org exploit
- DSA-1481 vendor-advisory
- 28354 third-party-advisory vendor-advisory
- 27181 vdb-entry
- 28611 third-party-advisory vendor-advisory
- 28620 third-party-advisory vendor-advisory
- 28769 third-party-advisory vendor-advisory
- 28353 third-party-advisory vendor-advisory
- ADV-2008-0039 vdb-entry vendor-advisory
- 20080124 rPSA-2008-0030-1 CherryPy mailing-list
- github.com vendor-advisory
- Debian Security Tracker CVE-2008-0252 vendor-advisory