Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:48442
HistoryAug 12, 2024 - 5:17 a.m.

Path Traversal

2024-08-1205:17:15
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
2
aiohttp
path traversal
symbolic links
compressed file
vulnerability

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.7

Confidence

Low

EPSS

0

Percentile

16.3%

JSON

aiohttp is vulnerable to Path Traversal. The vulnerability is due to improper handling of symbolic links in compressed file variants (.gz or .br extensions), which can allow access outside the root directory when follow_symlinks=False is set.

Related

cvelist 1
nvd 1
osv 6
vulnrichment 1
ibm 2
nessus 1
redhatcve 1
ubuntucve 1
openvas 3
wolfi 1
cve 1
debiancve 1
github 1
cvelist
cvelist
CVE-2024-42367 In aiohttp, compressed files as symlinks are not protected from path traversal
2024-08-09 17:25:22
nvd
nvd
CVE-2024-42367
2024-08-12 13:38:34
osv
osv
CGA-hc9m-rgpj-x5m5
2024-08-11 12:04:44
python310-aiohttp-3.10.5-1.1 on GA media
2024-08-20 00:00:00
CGA-4pvr-9jgj-4vq4
2024-08-23 10:04:52
vulnrichment
vulnrichment
CVE-2024-42367 In aiohttp, compressed files as symlinks are not protected from path traversal
2024-08-09 17:25:22
ibm
ibm
Security Bulletin: IBM Maximo Application Suite - AI Broker component usesaiohttp-3.9.5-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl which is vulnerable to this CVE-2024-42367
2024-09-09 08:14:15
Security Bulletin: IBM Maximo Application Suite - Predict Component component uses aiohttp-3.9.5-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl which is vulnerable to this CVE-2024-42367
2024-09-09 08:21:37
nessus
nessus
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-aiohttp (SUSE-SU-2024:3110-1)
2024-09-04 00:00:00
redhatcve
redhatcve
CVE-2024-42367
2024-08-15 17:19:24
ubuntucve
ubuntucve
CVE-2024-42367
2024-08-12 00:00:00
openvas
openvas
aiohttp < 3.10.2 Path Traversal Vulnerability - Linux
2024-08-13 00:00:00
aiohttp < 3.10.2 Path Traversal Vulnerability - Windows
2024-08-13 00:00:00
openSUSE: Security Advisory for python (SUSE-SU-2024:3110-1)
2024-09-06 00:00:00
wolfi
wolfi
CVE-2024-42367 vulnerabilities
2024-09-19 21:18:36
cve
cve
CVE-2024-42367
2024-08-12 13:38:34
debiancve
debiancve
CVE-2024-42367
2024-08-12 13:38:34
github
github
In aiohttp, compressed files as symlinks are not protected from path traversal
2024-08-09 16:49:58

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.7

Confidence

Low

EPSS

0

Percentile

16.3%

JSON
Related for VERACODE:48442
cvelist1nvd1osv6vulnrichment1ibm2nessus1redhatcve1ubuntucve1openvas3wolfi1cve1debiancve1github1