CVE-2021-40978
HIGH7.5EPSS 79.7%Directory traversal in mkdocs
發布日:2021/10/12修改日:2026/4/28
描述
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1
受影響套件(3)
- Debian/python-mkdocsfrom 0
- PyPI/mkdocs>= 1.2.2, < 1.2.3
- PyPI/mkdocs>= 1.2.2, < 1.2.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
參考連結(11)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-40978
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-40978
- PATCHhttps://github.com/mkdocs/mkdocs
- WEBhttps://github.com/mkdocs/mkdocs/commit/1b15412f4caae476c262210315fd068d0521a833
- WEBhttps://github.com/mkdocs/mkdocs/commit/57540911a0d632674dd23edec765189f96f84f6b
- WEBhttps://github.com/mkdocs/mkdocs/issues/2601
- WEBhttps://github.com/mkdocs/mkdocs/pull/2604
- WEBhttps://github.com/mkdocs/mkdocs/releases/tag/1.2.3
- WEBhttps://github.com/nisdn/CVE-2021-40978
- WEBhttps://github.com/nisdn/CVE-2021-40978/issues/1
- WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/mkdocs/PYSEC-2021-878.yaml