Vulnerability CVE-2019-14751
Published: 2019-08-22

Description:
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

Type:

CWE-22

 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
NLTK -> NLTK 

 References:
https://github.com/mssalvatore/CVE-2019-14751_PoC
https://github.com/nltk/nltk/blob/3.4.5/ChangeLog
https://github.com/nltk/nltk/commit/f59d7ed8df2e0e957f7f247fe218032abdbe9a10
https://salvatoresecurity.com/zip-slip-in-nltk-cve-2019-14751/
Copyright 2024, cxsecurity.com

 

Back to Top