PT-2014-5556 · Pyplate · Pyplate

Henri Salo · Publicado 2014-08-07 · Atualizado 2014-08-07 · CVE-2014-3855

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pyplate version 0.08

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by including a .. (dot dot) in the filename parameter of the download.py module.

Recommendations For Pyplate version 0.08, consider restricting access to the download.py module or validating the filename parameter to prevent directory traversal attacks until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-3855

Produtos afetados

Pyplate

Referências · 3

• 🔥 http://openwall.com/lists/oss-security/2014/05/14/3 · Exploit
• http://openwall.com/lists/oss-security/2014/05/23/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3855 · Nota de Segurança