NVD

Id
237  
Name
CVE-2008-0252  
Description
Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-01-11  
Modified Date
2011-03-07  
Seq
2008-0252  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
1713 237 CVE-2008-0252 GLSA-200801-11  View
1714 237 CVE-2008-0252 http://www.cherrypy.org/changeset/1774  View
1715 237 CVE-2008-0252 http://www.cherrypy.org/changeset/1775  View
1716 237 CVE-2008-0252 http://www.cherrypy.org/changeset/1776  View
1717 237 CVE-2008-0252 http://www.cherrypy.org/ticket/744  View
1718 237 CVE-2008-0252 DSA-1481  View
1719 237 CVE-2008-0252 20080124 rPSA-2008-0030-1 CherryPy  View
1720 237 CVE-2008-0252 27181  View
1721 237 CVE-2008-0252 ADV-2008-0039  View
1722 237 CVE-2008-0252 https://bugs.gentoo.org/show_bug.cgi?id=204829  View
1723 237 CVE-2008-0252 https://issues.rpath.com/browse/RPL-2127  View
1724 237 CVE-2008-0252 FEDORA-2008-0299  View
1725 237 CVE-2008-0252 FEDORA-2008-0333  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
47279 JVNDB-2008-002589 複数の製品の _get_file_path 関数におけるディレクトリトラバーサルの脆弱性 CherryPy の (1) lib/sessions.py、(2) filter/sessionfilter.py、および (3) filter/sessionfilter.py 内の _get_file_path 関数には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2008-0252 30365 CVE-2008-0252 237 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002589.html 2008-01-11 2012-06-26 View