CVE-2008-0252
Last modified
CVE-2008-0252 is a vulnerability of currently unknown severity. Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.. EPSS estimates a 2.65% chance of exploitation in the next 30 days.
Description
Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cherrypy | Cherrypy | <= 2.1.0 |
| Cherrypy | Cherrypy | <= 3.0.2 |
References
- http://secunia.com/advisories/28354Vendor Advisory
- http://www.cherrypy.org/changeset/1774Exploit, Patch
- http://www.cherrypy.org/changeset/1775Exploit, Patch
- http://secunia.com/advisories/28354Vendor Advisory
- http://www.cherrypy.org/changeset/1774Exploit, Patch
- http://www.cherrypy.org/changeset/1775Exploit, Patch
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2008-0252?
How severe is CVE-2008-0252?
How do I fix CVE-2008-0252?
Are you affected by CVE-2008-0252?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST