PT-2018-13600 · Python · Simplehttpserver

Vulzzz · Published 2018-12-04 · Updated 2019-10-09 · CVE-2018-16478

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions simplehttpserver versions <=0.2.1 simplehttpserver versions (all versions are affected)

Description The issue allows an attacker to access files outside the webroot due to a Path Traversal vulnerability. This is possible because the vulnerability enables symlink navigation in the URL, allowing the listing of any file in another folder of the web root.

Recommendations For simplehttpserver versions <=0.2.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For all versions of simplehttpserver: Do not use simplehttpserver in production or consider using an alternative module until a fix is made available.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-16478

GHSA-VWR2-WJ63-86GR

Affected Products

Simplehttpserver

References · 8

• https://osv.dev/vulnerability/CVE-2018-16478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16478 · Security Note
• https://osv.dev/vulnerability/GHSA-vwr2-wj63-86gr · Vendor Advisory
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/484.json · Note
• https://github.com/tikonen/blog/tree/master/simplehttpserver · Note
• https://github.com/advisories/GHSA-vwr2-wj63-86gr · Note
• https://hackerone.com/reports/403703 · Note
• https://npmjs.com/advisories/744 · Note