Directory traversal vulnerability in the _get_file_path function in (1) lib/sessions.py in CherryPy 3.0.x up to 3.0.2, (2) filter/sessionfilter.py in CherryPy 2.1, and (3) filter/sessionfilter.py in CherryPy 2.x allows remote attackers to create or delete arbitrary files, and possibly read and write portions of arbitrary files, via a crafted session id in a cookie.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2008-01-12T02:00:00
Updated: 2018-10-15T20:57:01
Reserved: 2008-01-11T00:00:00
Link: CVE-2008-0252
JSON object: View
NVD Information
Status : Modified
Published: 2008-01-12T02:46:00.000
Modified: 2018-10-15T21:58:53.360
Link: CVE-2008-0252
JSON object: View
Redhat Information
No data.
CWE