CVE-2022-35920

Опубликовано: 01 авг. 2022

Источник: nvd

CVSS3: 8.3

CVSS3: 7.5

EPSS Низкий

Описание

Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.

Ссылки

https://github.com/sanic-org/sanic/issues/2478
Exploit
Issue Tracking
Third Party Advisory
https://github.com/sanic-org/sanic/pull/2495
Patch
Third Party Advisory
https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6
Third Party Advisory
https://github.com/sanic-org/sanic/issues/2478
Exploit
Issue Tracking
Third Party Advisory
https://github.com/sanic-org/sanic/pull/2495
Patch
Third Party Advisory
https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sanic_project:sanic:*:*:*:*:*:*:*:*

Версия до 20.12.7 (исключая)

cpe:2.3:a:sanic_project:sanic:*:*:*:*:*:*:*:*

Версия от 21.0.0 (включая) до 21.12.2 (исключая)

cpe:2.3:a:sanic_project:sanic:*:*:*:*:*:*:*:*

Версия от 22.0.0 (включая) до 22.6.1 (исключая)

EPSS

Процентиль: 73%

0.0075

Низкий

8.3 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

GHSA-8cw9-5hmv-77w6

CVSS3: 8.3

github

больше 3 лет назад

sanic vulnerable to Path Traversal when using `app.static` if using encoded `%2F` URLs

EPSS

Процентиль: 73%

0.0075

Низкий

8.3 High

CVSS3

7.5 High

CVSS3

Дефекты

CWE-22