GHSA-84cw-mxhv-qvv4

Suggest an improvement
Source
https://github.com/advisories/GHSA-84cw-mxhv-qvv4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-84cw-mxhv-qvv4/GHSA-84cw-mxhv-qvv4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-84cw-mxhv-qvv4
Aliases
Published
2022-05-17T03:43:03Z
Modified
2024-02-16T08:15:45.072926Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component
Details

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2016-02-03T18:59:00Z",
    "severity": "CRITICAL",
    "github_reviewed_at": "2023-08-02T22:33:28Z"
}
References

Affected packages

PyPI / radicale

Package

Name
radicale
View open source insights on deps.dev
Purl
pkg:pypi/radicale

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1

Affected versions

0.*
0.2
0.3
0.4
0.5
0.6
0.6.1
0.6.2
0.6.3
0.6.4
0.7
0.7.1
0.8
0.9b1
0.9b2
0.9
0.10
1.*
1.0
1.0.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-84cw-mxhv-qvv4/GHSA-84cw-mxhv-qvv4.json"