NVD

Id
42942  
Name
CVE-2012-0878  
Description
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.  
Reject
 
CVSS Version
2  
CVSS Score
5.1  
Severity
Medium  
CVSS Base Score
5.1  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2012-05-01  
Modified Date
2013-04-01  
Seq
2012-0878  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
216202 42942 CVE-2012-0878 http://groups.google.com/group/paste-users/browse_thread/thread/2aa651ba331c2471  View
216203 42942 CVE-2012-0878 RHSA-2012:1206  View
216204 42942 CVE-2012-0878 [oss-security] 20120223 CVE Request -- python-paste-script: Supplementary groups not dropped when started an application with "paster serve" as root  View
216205 42942 CVE-2012-0878 [oss-security] 20120223 Re: CVE Request -- python-paste-script: Supplementary groups not dropped when started an application with "paster serve" as root  View
216206 42942 CVE-2012-0878 https://bitbucket.org/ianb/pastescript/changeset/a19e462769b4  View
216207 42942 CVE-2012-0878 https://bitbucket.org/ianb/pastescript/pull-request/3/fix-group-permissions-for-pastescriptserve  View
216208 42942 CVE-2012-0878 https://bugzilla.redhat.com/show_bug.cgi?id=796790  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
26474 JVNDB-2012-002181 Paste Script におけるファイルアクセス制限を回避される脆弱性 Paste Script は、root 権限による実行中、グループメンバシップを適切に設定しないため、ファイルアクセス制限を回避される脆弱性が存在します。 CVE-2012-0878 54116 CVE-2012-0878 42942 5.1 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002181.html 2012-05-01 2012-11-13 View