CVE - CVE-2008-0252

CVE-ID
CVE-2008-0252	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:27181 URL:http://www.securityfocus.com/bid/27181 BUGTRAQ:20080124 rPSA-2008-0030-1 CherryPy URL:http://www.securityfocus.com/archive/1/487001/100/0/threaded CONFIRM:http://www.cherrypy.org/changeset/1774 CONFIRM:http://www.cherrypy.org/changeset/1775 CONFIRM:http://www.cherrypy.org/changeset/1776 CONFIRM:http://www.cherrypy.org/ticket/744 CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=204829 CONFIRM:https://issues.rpath.com/browse/RPL-2127 DEBIAN:DSA-1481 URL:http://www.debian.org/security/2008/dsa-1481 FEDORA:FEDORA-2008-0299 URL:https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00240.html FEDORA:FEDORA-2008-0333 URL:https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00297.html GENTOO:GLSA-200801-11 URL:http://security.gentoo.org/glsa/glsa-200801-11.xml SECUNIA:28353 URL:http://secunia.com/advisories/28353 SECUNIA:28354 URL:http://secunia.com/advisories/28354 SECUNIA:28611 URL:http://secunia.com/advisories/28611 SECUNIA:28620 URL:http://secunia.com/advisories/28620 SECUNIA:28769 URL:http://secunia.com/advisories/28769 VUPEN:ADV-2008-0039 URL:~~http://www.vupen.com/english/advisories/2008/0039~~ (Obsolete source)
Assigning CNA
MITRE Corporation
Date Record Created
20080111	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20080111)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)