PT-2018-18100 · Uwsgi+1 · Uwsgi+1

Marios Nicolaides + 2 · CVE-2018-7490 · Published 2018-02-26 · Updated 2023-08-14

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions uWSGI versions prior to 2.0.17

Description The issue arises from the mishandling of a DOCUMENT ROOT check during the use of the --php-docroot option, allowing directory traversal.

Recommendations For versions prior to 2.0.17, update to version 2.0.17 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2019-3150

ALT-PU-2023-4765

CVE-2018-7490

DSA-4142-1

GHSA-H2VM-C85R-5VH5

PYSEC-2018-78

Affected Products

Alt Linux

Uwsgi

References · 19

• 🔥 https://exploit-db.com/exploits/44223 · Exploit
• https://debian.org/security/2018/dsa-4142 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7490 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h2vm-c85r-5vh5 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-78 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7490 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-7490 · Vendor Advisory
• https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.17.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7490 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4142-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-7490 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-7490 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-7490 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7490 · Security Note
• https://github.com/unbit/uwsgi · Note