Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote attackers to read arbitrary files via ".." sequences in unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal vulnerability in the staticfilter component in CherryPy before 2.1.1 allows remote
    attackers to read arbitrary files via ".." sequences in unspecified vectors. (CVE-2006-0847)

The remote host is affected by the vulnerability described in GLSA-200605-16 (CherryPy: Directory traversal vulnerability)

    Ivo van der Wijk discovered that the 'staticfilter' component of     CherryPy fails to sanitize input correctly.
  Impact :

    An attacker could exploit this flaw to obtain arbitrary files from     the web server.
  Workaround :

    There is no known workaround at this time.

The remote host is running CherryPy, a web-based content management system written in python.  This version of CherryPy is vulnerable to a directory traversal flaw.  An attacker exploiting this flaw would send a malformed query to the application.  Successful exploitation would result in the attacker being able to access confidential data outside of the web root directory.

The remote host is running CherryPy, a web server powered by Python. 

The installed version of CherryPy fails to filter directory traversal sequences from requests that pass through its 'staticFilter' module. An attacker can exploit this issue to read arbitrary files on the remote host subject to the privileges under which the affected application runs.

ID	Name	Product	Family	Type	Severity
433780	SCA: security update for cherrypy (GHSA-vx77-5pf4-c9wr)	Tenable Cloud Security	SCA Checks	Local	high
433780	SCA: security update for cherrypy (GHSA-vx77-5pf4-c9wr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
21614	GLSA-200605-16 : CherryPy: Directory traversal vulnerability	Nessus	Gentoo Local Security Checks	Local	medium
3442	CherryPy < 2.1.1 staticfilter Directory Traversal Arbitrary File Access	Nessus Network Monitor	Web Servers		medium
20961	CherryPy staticFilter Traversal Arbitrary File Access	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2006-0847

high

Tenable Plugins

high

high

medium

medium

medium