CVE-2008-0252: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the getfilepath function in 1 lib/sessions.py in CherryPy 3.0.x up to 3.0.2, 2 filter/sessionfilter.py in CherryPy 2.1, and 3 filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write...

CherryPy Cookie会话Id信息泄露漏洞

BUGTRAQ ID: 27181 CherryPy是Python编写的面向对象的HTTP框架。 CherryPy在处理Cookie数据时存在漏洞，远程攻击者可能利用此漏洞访问系统上的任意文件。 如果用户通过cookie提供了恶意的会话ID的话，且服务器在使用基于文件的会话，应用程序就可能引用会话目录之外的文件（文件名以SESSIONPREFIX开始）。 cherrypy.org CherryPy 3.0.2 cherrypy.org CherryPy 2.1.1 cherrypy.org ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

[SECURITY] Fedora 7 Update: python-cherrypy-2.2.1-8.fc7

CherryPy allows developers to build web applications in much the same way they would build any other object-oriented Python program. This usually results in smaller source code developed in less time...

[SECURITY] Fedora 8 Update: python-cherrypy-2.2.1-8.fc8

CherryPy allows developers to build web applications in much the same way they would build any other object-oriented Python program. This usually results in smaller source code developed in less time...

Fedora 7 : python-cherrypy-2.2.1-8.fc7 (2008-0333)

Fixes a security issue with a backport from upstream. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 8 : python-cherrypy-2.2.1-8.fc8 (2008-0299)

Security issue fixed with a backport from upstream. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

GLSA-200605-16 : CherryPy: Directory traversal vulnerability

The remote host is affected by the vulnerability described in GLSA-200605-16 CherryPy: Directory traversal vulnerability Ivo van der Wijk discovered that the 'staticfilter' component of CherryPy fails to sanitize input correctly. Impact : An attacker could exploit this flaw to obtain arbitrary...

[Full-disclosure] [ GLSA 200605-16 ] CherryPy: Directory traversal vulnerability

Gentoo Linux Security Advisory GLSA 200605-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

CherryPy: Directory traversal vulnerability

Background CherryPy is a Python-based, object-oriented web development framework. Description Ivo van der Wijk discovered that the "staticfilter" component of CherryPy fails to sanitize input correctly. Impact An attacker could exploit this flaw to obtain arbitrary files from the web server...

CVE-2006-0847

Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors...

Directory traversal

Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors...

PYSEC-2006-1

Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors...

CVE-2006-0847

Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors...

PYSEC-2006-1

Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors...

CVE-2006-0847

Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors...

CVE-2006-0847

CherryPy’s staticfilter component contains a directory traversal vulnerability (CVE-2006-0847) that allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors. Affected: CherryPy prior to 2.1.1. Impact: could expose arbitrary server files. Root cause: inadequate inp...

CVE-2006-0847

Removed by vendor...

CherryPy staticFilter Traversal Arbitrary File Access

The remote host is running CherryPy, a web server powered by Python. The installed version of CherryPy fails to filter directory traversal sequences from requests that pass through its 'staticFilter' module. An attacker can exploit this issue to read arbitrary files on the remote host subject to...

CherryPy < 2.1.1 staticfilter Directory Traversal Arbitrary File Access

Binary data 3442.prm...

CVE-2006-0847: Undefined Security Weakness

Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors...