PT-2018-18100 · Uwsgi+1 · Uwsgi+1

Marios Nicolaides + 2 · Publicado 2018-02-26 · Atualizado 2023-08-14 · CVE-2018-7490

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions uWSGI versions prior to 2.0.17

Description The issue arises from the mishandling of a DOCUMENT ROOT check during the use of the --php-docroot option, allowing directory traversal.

Recommendations For versions prior to 2.0.17, update to version 2.0.17 or later to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

ALT-PU-2019-3150

ALT-PU-2023-4765

CVE-2018-7490

DSA-4142-1

GHSA-H2VM-C85R-5VH5

PYSEC-2018-78

Produtos afetados

Alt Linux

Uwsgi

Referências · 26

• 🔥 https://exploit-db.com/exploits/44223 · Exploit
• https://github.com/unbit/uwsgi/commit/0a480f435ea6feb63deb410ad2bf376ed3f05f8a · Nota
• https://github.com/unbit/uwsgi · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/uwsgi/PYSEC-2018-78.yaml · Nota
• https://errata.altlinux.org/ALT-PU-2023-4765 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7490 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6758 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7490 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2018-7490 · Nota
• https://osv.dev/vulnerability/GHSA-h2vm-c85r-5vh5 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-7490 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-4142-1 · Aviso do Fabricante
• https://debian.org/security/2018/dsa-4142 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4142-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7490 · Nota de Segurança