CVE-2016-1505
CRITICAL10.0EPSS 1.3%Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component
發布日:2022/5/17修改日:2024/2/16
描述
The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.
受影響套件(1)
- PyPI/radicalefrom 0, < 1.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
參考連結(9)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-1505
- PATCHhttps://github.com/Kozea/Radicale
- WEBhttps://github.com/Kozea/Radicale/commit/b4b3d51f33c7623d312f289252dd7bbb8f58bbe6
- WEBhttps://github.com/Kozea/Radicale/pull/343
- WEBhttp://www.openwall.com/lists/oss-security/2016/01/05/7
- WEBhttp://www.openwall.com/lists/oss-security/2016/01/06/4
- WEBhttp://www.openwall.com/lists/oss-security/2016/01/06/7
- WEBhttp://www.openwall.com/lists/oss-security/2016/01/07/7
- WEBhttp://www.securityfocus.com/bid/80255