PT-2011-4884

Name of the Vulnerable Software and Affected Versions Google App Engine Python SDK versions prior to 1.5.4 Description The issue is related to the FakeFile implementation in the sandbox environment, which does not properly control the opening of files. This allows local users to bypass intended...

PT-2011-4886

Name of the Vulnerable Software and Affected Versions Google App Engine Python SDK versions prior to 1.5.4 Description The issue is related to the sandbox environment in the Google App Engine Python SDK, which does not properly restrict the use of the os module. This allows local users to bypass...

PT-2011-3085

Name of the Vulnerable Software and Affected Versions Google App Engine Python SDK versions prior to 1.5.4 Description A cross-site request forgery CSRF issue exists in the Interactive Console of the Google App Engine Python SDK. This allows remote attackers to hijack the authentication of...

PT-2011-4885

Name of the Vulnerable Software and Affected Versions Google App Engine Python SDK versions prior to 1.5.4 Description The issue is related to the sandbox environment in the Google App Engine Python SDK, which does not properly prevent os.popen calls. This allows local users to bypass intended...

CVE-2011-4212: Undefined Security Weakness

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a devappserver.RestrictedPathFunction.originalos reference within the code paramete...

CVE-2011-4211: Undefined Security Weakness

The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWEDMODES and ALLOWEDDIRS changes within the co...

CVE-2011-4213: Undefined Security Weakness

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local users to bypass intended access restrictions and execute arbitrary commands via a fileblobstorage.os reference within the code parameter to...

CVE-2011-1364: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ah/admin/interactive/execute aka the Interactive Console in the SDK Console aka Admin Console in the Google App Engine Python SDK before 1.5.4 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrar...