Multiple vulnerabilities in Pylons Pyramid

Published: 2023-08-28 | Updated: 2023-09-11

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2023-40587 CVE-2023-41105
CWE-ID	CWE-22
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	pyramid Web applications / CMS
Vendor	Pylons Project

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

Updated 11.09.2023

Added vulnerability #2

1) Path traversal

EUVDB-ID: #VU80042

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-40587

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing null-byte characters. A remote attacker can disclose content of "index.html" file exactly one directory above the location of the static view's file system path.

Mitigation

Install update from vendor's website.

Vulnerable software versions

pyramid: 2.0 - 2.0.1

External links

http://github.com/Pylons/pyramid/commit/347d7750da6f45c7436dd0c31468885cc9343c85
http://github.com/python/cpython/issues/106242
http://github.com/python/cpython/pull/106816
http://github.com/Pylons/pyramid/security/advisories/GHSA-j8g2-6fc7-q8f8

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Path traversal

EUVDB-ID: #VU80585