CVE-2011-1589 Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.
MediumCVSS 5.0
EPSS 3.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mojolicious | = 0.2 | No fix listed |
| mojolicious | = 0.3 | No fix listed |
| mojolicious | = 0.4 | No fix listed |
| mojolicious | = 0.5 | No fix listed |
| mojolicious | = 0.6 | No fix listed |
| mojolicious | = 0.7 | No fix listed |
| mojolicious | = 0.8 | No fix listed |
| mojolicious | = 0.8.1 | No fix listed |
| mojolicious | = 0.8.2 | No fix listed |
| mojolicious | = 0.8.3 | No fix listed |
| mojolicious | = 0.8.4 | No fix listed |
| mojolicious | = 0.8.5 | No fix listed |
| mojolicious | = 0.9 | No fix listed |
| mojolicious | = 0.8006 | No fix listed |
| mojolicious | = 0.8007 | No fix listed |
| mojolicious | = 0.8008 | No fix listed |
| mojolicious | = 0.8009 | No fix listed |
| mojolicious | = 0.9001 | No fix listed |
| mojolicious | = 0.9002 | No fix listed |
| mojolicious | = 0.991231 | No fix listed |
| mojolicious | = 0.991232 | No fix listed |
| mojolicious | = 0.991233 | No fix listed |
| mojolicious | = 0.991234 | No fix listed |
| mojolicious | = 0.991235 | No fix listed |
| mojolicious | = 0.991236 | No fix listed |
Show 60 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mojolicious | = 0.991237 | No fix listed |
| mojolicious | = 0.991238 | No fix listed |
| mojolicious | = 0.991239 | No fix listed |
| mojolicious | = 0.991240 | No fix listed |
| mojolicious | = 0.991241 | No fix listed |
| mojolicious | = 0.991242 | No fix listed |
| mojolicious | = 0.991243 | No fix listed |
| mojolicious | = 0.991244 | No fix listed |
| mojolicious | = 0.991245 | No fix listed |
| mojolicious | = 0.991246 | No fix listed |
| mojolicious | = 0.991250 | No fix listed |
| mojolicious | = 0.991251 | No fix listed |
| mojolicious | = 0.999901 | No fix listed |
| mojolicious | = 0.999902 | No fix listed |
| mojolicious | = 0.999903 | No fix listed |
| mojolicious | = 0.999904 | No fix listed |
| mojolicious | = 0.999905 | No fix listed |
| mojolicious | = 0.999906 | No fix listed |
| mojolicious | = 0.999907 | No fix listed |
| mojolicious | = 0.999908 | No fix listed |
| mojolicious | = 0.999909 | No fix listed |
| mojolicious | = 0.999910 | No fix listed |
| mojolicious | = 0.999911 | No fix listed |
| mojolicious | = 0.999912 | No fix listed |
| mojolicious | = 0.999913 | No fix listed |
| mojolicious | = 0.999914 | No fix listed |
| mojolicious | = 0.999920 | No fix listed |
| mojolicious | = 0.999921 | No fix listed |
| mojolicious | = 0.999922 | No fix listed |
| mojolicious | = 0.999923 | No fix listed |
| mojolicious | = 0.999924 | No fix listed |
| mojolicious | = 0.999925 | No fix listed |
| mojolicious | = 0.999926 | No fix listed |
| mojolicious | = 0.999927 | No fix listed |
| mojolicious | = 0.999928 | No fix listed |
| mojolicious | = 0.999929 | No fix listed |
| mojolicious | = 0.999930 | No fix listed |
| mojolicious | = 0.999931 | No fix listed |
| mojolicious | = 0.999932 | No fix listed |
| mojolicious | = 0.999933 | No fix listed |
| mojolicious | = 0.999934 | No fix listed |
| mojolicious | = 0.999935 | No fix listed |
| mojolicious | = 0.999936 | No fix listed |
| mojolicious | = 0.999937 | No fix listed |
| mojolicious | = 0.999938 | No fix listed |
| mojolicious | = 0.999939 | No fix listed |
| mojolicious | = 0.999940 | No fix listed |
| mojolicious | = 0.999941 | No fix listed |
| mojolicious | = 0.999950 | No fix listed |
| mojolicious | = 1.0 | No fix listed |
| mojolicious | = 1.1 | No fix listed |
| mojolicious | = 1.01 | No fix listed |
| mojolicious | = 1.11 | No fix listed |
| mojolicious | = 1.12 | No fix listed |
| mojolicious | = 1.13 | No fix listed |
| mojolicious | = 1.14 | No fix listed |
| mojolicious | = 1.15 | No fix listed |
| debian/libmojolicious-perl(Debian:12) | < 1.16-1 | 1.16-1 |
| debian/libmojolicious-perl(Debian:13) | < 1.16-1 | 1.16-1 |
| debian/libmojolicious-perl(Debian:14) | < 1.16-1 | 1.16-1 |
References
- bugs.debian.org exploit
- cpansearch.perl.org
- FEDORA-2011-5504 vendor-advisory
- FEDORA-2011-5505 vendor-advisory
- [oss-security] 20110416 CVE request: Mojolicious directory traversal vulnerability exploit mailing-list patch
- [oss-security] 20110418 CVE request: Mojolicious exploit mailing-list patch
- [oss-security] 20110418 Re: CVE request: Mojolicious directory traversal vulnerability exploit mailing-list
- perlninja.posterous.com
- search.cpan.org patch
- 44051 third-party-advisory vendor-advisory
- 44359 third-party-advisory
- DSA-2221 vendor-advisory
- 71850 exploit vdb-entry
- 47402 vdb-entry
- ADV-2011-1072 vdb-entry
- ADV-2011-1093 vdb-entry
- bugzilla.redhat.com exploit patch
- mojolicious-url-directory-traversal(66830) vdb-entry
- github.com patch
- github.com exploit
- Debian Security Tracker CVE-2011-1589 vendor-advisory