CVE-2017-9031 The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.
CriticalCVSS 9.8
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/deluge(Debian:12) | < 1.3.13+git20161130.48cedf63-3 | 1.3.13+git20161130.48cedf63-3 |
| debian/deluge(Debian:13) | < 1.3.13+git20161130.48cedf63-3 | 1.3.13+git20161130.48cedf63-3 |
| debian/deluge(Debian:14) | < 1.3.13+git20161130.48cedf63-3 | 1.3.13+git20161130.48cedf63-3 |
| deluge-torrent deluge | <= 1.3.14 | No fix listed |
References
- Debian Security Tracker CVE-2017-9031 vendor-advisory
- dev.deluge-torrent.org release-notes vendor-advisory
- git.deluge-torrent.org patch vendor-advisory
- DSA-3856 vendor-advisory
- 99099 vdb-entry
- bugs.debian.org issue-tracking mailing-list patch third-party-advisory