PT-2014-5556 · Pyplate · Pyplate

Henri Salo · Published 2014-08-07 · Updated 2014-08-07 · CVE-2014-3855

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pyplate version 0.08

Description A directory traversal issue exists, allowing remote attackers to read arbitrary files by including a .. (dot dot) in the filename parameter of the download.py module.

Recommendations For Pyplate version 0.08, consider restricting access to the download.py module or validating the filename parameter to prevent directory traversal attacks until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-3855

Affected Products

Pyplate

References · 3

• 🔥 http://openwall.com/lists/oss-security/2014/05/14/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3855 · Security Note
• http://openwall.com/lists/oss-security/2014/05/23/1 · Note