Published: 12/01/2008 Updated: 15/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote malicious users to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cherrypy cherrypy

Debian Bug report logs - #461069 python-cherrypy: CVE-2008-0252 directory traversal vulnerability Package: python-cherrypy; Maintainer for python-cherrypy is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Source for python-cherrypy is src:python-cherrypy (PTS, buildd, popcon) Reported by: Nico Gold ...

It was discovered that a directory traversal vulnerability in CherryPy, a pythonic, object-oriented web development framework, may lead to denial of service by deleting files through malicious session IDs in cookies The old stable distribution (sarge) doesn't contain python-cherrypy For the stable distribution (etch), this problem has been fixed ...

CWE-22 http://www.cherrypy.org/changeset/1774 http://www.cherrypy.org/changeset/1775 http://www.cherrypy.org/changeset/1776 http://www.cherrypy.org/ticket/744 https://bugs.gentoo.org/show_bug.cgi?id=204829 http://secunia.com/advisories/28354 https://issues.rpath.com/browse/RPL-2127 http://www.securityfocus.com/bid/27181 http://secunia.com/advisories/28611 http://security.gentoo.org/glsa/glsa-200801-11.xml http://secunia.com/advisories/28620 http://www.debian.org/security/2008/dsa-1481 http://secunia.com/advisories/28769 http://secunia.com/advisories/28353 https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00297.html https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00240.html http://www.vupen.com/english/advisories/2008/0039 http://www.securityfocus.com/archive/1/487001/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=461069 https://nvd.nist.gov https://www.debian.org/security/./dsa-1481

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2008-0252

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect