PT-2018-16184 · Buttle · Buttle

Published 2018-07-05 · Updated 2023-02-28 · CVE-2018-3766

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions buttle versions <= 0.2.0

Description The issue concerns a path traversal vulnerability in the buttle module, allowing attackers to read any file on the server due to insufficient input sanitization. This can be exploited by using relative paths when fetching files.

Recommendations For buttle versions <= 0.2.0, consider using an alternative module until a fix is made available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-3766

GHSA-M8CR-Q935-8J67

Affected Products

Buttle

References · 6

• 🔥 https://hackerone.com/reports/358112 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3766 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3766 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m8cr-q935-8j67 · Vendor Advisory
• https://npmjs.com/advisories/990 · Note
• https://github.com/advisories/GHSA-m8cr-q935-8j67 · Note