Vulnerability CVE-2014-5269
Published: 2014-09-04

Description:
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.

Type:

CWE-264

 (Permissions, Privileges, and Access Controls)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Plack project -> Plack 

 References:
https://github.com/plack/Plack/issues/405
https://github.com/avar/Plack/commit/bc1731dbb53850c380875ad683cd87c8ec99eee3
http://www.osvdb.org/109928
http://seclists.org/oss-sec/2014/q3/384
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137115.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137099.html
http://api.metacpan.org/source/MIYAGAWA/Plack-1.0031/Changes
Copyright 2024, cxsecurity.com

 

Back to Top