#VU11219 Path traversal in uWSGI - CVE-2018-7490

Vulnerability identifier: #VU11219

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear

CVE-ID: CVE-2018-7490

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerable software:
uWSGI

Software vendor:
Unbit

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper file path validation when requesting a resource under the DOCUMENT_ROOT directory. A remote attacker can cause path traversal and gain access to potentially sensitive information.

Update to version 2.0.17.

• https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.17.html