PT-2011-3240 · Mojolicious · Mojolicious

Vti · Publicado 2011-04-29 · Atualizado 2017-08-17 · CVE-2011-1589

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mojolicious versions prior to 1.16

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by including a %2f..%2f (encoded slash dot dot slash) in a URI.

Recommendations For versions prior to 1.16, update to version 1.16 or later to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-1589

DSA-2221-1

Produtos afetados

Mojolicious

Referências · 24

• 🔥 https://github.com/kraih/mojo/issues/114 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=697229 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/04/17/1 · Exploit
• 🔥 http://osvdb.org/71850 · Exploit
• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/04/18/7 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/04/18/3 · Exploit
• https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818 · Correção
• http://securityfocus.com/bid/47402 · Nota
• https://osv.dev/vulnerability/CVE-2011-1589 · Aviso do Fabricante
• http://secunia.com/advisories/44051 · Aviso do Fabricante
• http://secunia.com/advisories/44359 · Nota
• http://debian.org/security/2011/dsa-2221 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66830 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058891.html · Aviso do Fabricante