CVE-2008-0252

2008-01-1200:00:00

ubuntu.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.009 Low

EPSS

Percentile

82.7%

JSON

Directory traversal vulnerability in the _get_file_path function in (1)
lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py
in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows
remote attackers to create or delete arbitrary files, and possibly read and
write portions of arbitrary files, via a crafted session id in a cookie.

Bugs

<https://bugs.launchpad.net/bugs/187481>

OSVersionArchitecturePackageVersionFilename
ubuntu7.10noarchcherrypy3< 3.0.2-1ubuntu0.1UNKNOWN
ubuntu7.04noarchpython-cherrypy< 2.2.1-3ubuntu1.7.04UNKNOWN
ubuntu7.10noarchpython-cherrypy< 2.2.1-3ubuntu1.7.10UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	7.10	noarch	cherrypy3	< 3.0.2-1ubuntu0.1	UNKNOWN
ubuntu	7.04	noarch	python-cherrypy	< 2.2.1-3ubuntu1.7.04	UNKNOWN
ubuntu	7.10	noarch	python-cherrypy	< 2.2.1-3ubuntu1.7.10	UNKNOWN