CVE-2016-1505
CRITICAL10.0EPSS 1.3%Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component
Published: 5/17/2022Modified: 2/16/2024
Also known as:GHSA-84cw-mxhv-qvv4
Description
The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.
Affected packages (1)
- PyPI/radicalefrom 0, < 1.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
References (9)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-1505
- PATCHhttps://github.com/Kozea/Radicale
- WEBhttps://github.com/Kozea/Radicale/commit/b4b3d51f33c7623d312f289252dd7bbb8f58bbe6
- WEBhttps://github.com/Kozea/Radicale/pull/343
- WEBhttp://www.openwall.com/lists/oss-security/2016/01/05/7
- WEBhttp://www.openwall.com/lists/oss-security/2016/01/06/4
- WEBhttp://www.openwall.com/lists/oss-security/2016/01/06/7
- WEBhttp://www.openwall.com/lists/oss-security/2016/01/07/7
- WEBhttp://www.securityfocus.com/bid/80255