JVN#41113329
Pyramid vulnerable to directory traversal
Overview
Pyramid provided by Pylons Project contains a directory traversal vulnerability.
Products Affected
Applications created with the following versions of Pyramid are affected when they are deployed with Python 3.11.0 to 3.11.4:
- Pyramid versions 2.0.0 and 2.0.1
Description
Pyramid provided by Pylons Project, which is a web framework for Python, contains a directory traversal vulnerability (CWE-22).
Impact
index.html located one directory above the location of the static view's file system path can be accessed via a crafted request.
Solution
Update the software
Update the software according to the information provided by the developer.
For more information, refer to the information provided by the developer.
Vendor Status
References
-
GHSA-65fx-pmw6-rcfm: CVE-2023-41105
An issue was discovered in Python 3.11 through 3.11.4.
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Comment
This analysis assumes that an affected system has index.html one directory above the static view's file system path, which is unintentionally accessible.
Credit
Masashi Yamane of LAC Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2023-40587 |
| JVN iPedia |
JVNDB-2023-000093 |