PT-2011-3240 · Mojolicious · Mojolicious

Vti · Published 2011-04-29 · Updated 2017-08-17 · CVE-2011-1589

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mojolicious versions prior to 1.16

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files. This is achieved by including a %2f..%2f (encoded slash dot dot slash) in a URI.

Recommendations For versions prior to 1.16, update to version 1.16 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-1589

DSA-2221-1

Affected Products

Mojolicious

References · 24

• 🔥 https://github.com/kraih/mojo/issues/114 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=697229 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/04/17/1 · Exploit
• 🔥 http://osvdb.org/71850 · Exploit
• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/04/18/7 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/04/18/3 · Exploit
• https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818 · Patch
• https://osv.dev/vulnerability/CVE-2011-1589 · Vendor Advisory
• http://secunia.com/advisories/44051 · Vendor Advisory
• http://debian.org/security/2011/dsa-2221 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058891.html · Vendor Advisory
• http://search.cpan.org/CPAN/authors/id/K/KR/KRAIH/Mojolicious-1.16.tar.gz · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058885.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1589 · Vendor Advisory