CVE-2013-7300 Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files via a full pathname in a request to the internal httpd server. NOTE: this vulnerability can be....
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files via a full pathname in a request to the internal httpd server. NOTE: this vulnerability can be leveraged by remote attackers using CVE-2013-7301.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| craig drummond cantata | <= 1.2.1 | No fix listed |
| craig drummond cantata | = 0.7.0 | No fix listed |
| craig drummond cantata | = 0.7.1 | No fix listed |
| craig drummond cantata | = 0.8.0 | No fix listed |
| craig drummond cantata | = 0.8.1 | No fix listed |
| craig drummond cantata | = 0.8.2 | No fix listed |
| craig drummond cantata | = 0.8.3 | No fix listed |
| craig drummond cantata | = 0.8.3.1 | No fix listed |
| craig drummond cantata | = 0.9.0 | No fix listed |
| craig drummond cantata | = 0.9.1 | No fix listed |
| craig drummond cantata | = 0.9.2 | No fix listed |
| craig drummond cantata | = 1.0.0 | No fix listed |
| craig drummond cantata | = 1.0.1 | No fix listed |
| craig drummond cantata | = 1.0.2 | No fix listed |
| craig drummond cantata | = 1.0.3 | No fix listed |
| craig drummond cantata | = 1.1.0 | No fix listed |
| craig drummond cantata | = 1.1.1 | No fix listed |
| craig drummond cantata | = 1.1.2 | No fix listed |
| craig drummond cantata | = 1.1.3 | No fix listed |
| craig drummond cantata | = 1.2.0 | No fix listed |
References
- [oss-security] 20140120 CVE request: Cantata vulnerability mailing-list
- [oss-security] 20140120 Re: CVE request: Cantata vulnerability mailing-list
- code.google.com exploit
- cantata-cve20137300-dir-traversal(90580) vdb-entry
- Debian Security Tracker CVE-2013-7300 vendor-advisory