Published:2023/09/11  Last Updated:2023/09/11

JVN#41113329
Pyramid vulnerable to directory traversal

Overview

Pyramid provided by Pylons Project contains a directory traversal vulnerability.

Products Affected

Applications created with the following versions of Pyramid are affected when they are deployed with Python 3.11.0 to 3.11.4:

  • Pyramid versions 2.0.0 and 2.0.1

Description

Pyramid provided by Pylons Project, which is a web framework for Python, contains a directory traversal vulnerability (CWE-22).

Impact

index.html located one directory above the location of the static view's file system path can be accessed via a crafted request.

Solution

Update the software
Update the software according to the information provided by the developer.

For more information, refer to the information provided by the developer.

References

  1. GHSA-65fx-pmw6-rcfm: CVE-2023-41105
    An issue was discovered in Python 3.11 through 3.11.4.

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score: 3.7
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:N/AC:M/Au:N/C:P/I:N/A:N
Base Score: 4.3
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Comment

This analysis assumes that an affected system has index.html one directory above the static view's file system path, which is unintentionally accessible.

Credit

Masashi Yamane of LAC Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2023-40587
JVN iPedia JVNDB-2023-000093