7.5high
CVE-2006-0847
CherryPy Directory traversal vulnerability
Also known as GHSA-vx77-5pf4-c9wr, PYSEC-2006-1
Published 20 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · GitHub
CISA KEV
No
not known exploited
EPSS
2.4%
percentile 84%
Public exploits
0
none known
Summary
Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors.
Exploit prediction (EPSS)
2.38% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | cherrypy | <2.1.1 | 2.1.1 |
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- cherrypy.org / · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/16760 · vdb-entry, x_refsource_BID, x_transferred
- secunia.com /advisories/18944 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- secunia.com /advisories/20344 · third-party-advisory, x_refsource_SECUNIA, x_transferred
- vupen.com /english/advisories/2006/0677 · vdb-entry, x_refsource_VUPEN, x_transferred
- gentoo.org /security/en/glsa/glsa-200605-16.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/24809 · vdb-entry, x_refsource_XF, x_transferred
- sourceforge.net /project/shownotes.php?release_id=384316&group_id=56099 · x_refsource_CONFIRM, x_transferred
- groups.google.com /group/cherrypy-announce/browse_thread/thread/92b2972f774fe6df/2f63afc9433dc306#2f63afc943 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2006-0847 · advisory
- github.com /cherrypy/cherrypy · package
- github.com /pypa/advisory-database/tree/main/vulns/cherrypy/PYSEC-2006-1.yaml · web
- web.archive.org /web/20140724140216/http://secunia.com/advisories/18944 · web
- web.archive.org /web/20140803230356/http://secunia.com/advisories/20344 · web
- web.archive.org /web/20200302050730/http://www.securityfocus.com/bid/16760 · web
- cherrypy.org · web
- github.com /advisories/GHSA-vx77-5pf4-c9wr · advisory
Sources
- CVE List: CVE-2006-0847
- GitHub Advisory: GHSA-vx77-5pf4-c9wr
- NVD: CVE-2006-0847
- OSV: PYSEC-2006-1
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.