CVE-2011-1589: Path Traversal
First published: Sun Apr 17 2011(Updated: )
A directory traversal flaw was found in Mojolicious [1]. Because Mojolicious did not unescape paths before processing them, a user could use it to view arbitrary files using '%2f' rather than '/' (for example: %2f..%2f). This has been corrected in upstream version 1.17 [2]. [1] <a href="https://github.com/kraih/mojo/issues/114">https://github.com/kraih/mojo/issues/114</a> [2] <a href="https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818">https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mojolicious | =0.2 | |
| Mojolicious | =0.3 | |
| Mojolicious | =0.4 | |
| Mojolicious | =0.5 | |
| Mojolicious | =0.6 | |
| Mojolicious | =0.7 | |
| Mojolicious | =0.8 | |
| Mojolicious | =0.8.1 | |
| Mojolicious | =0.8.2 | |
| Mojolicious | =0.8.3 | |
| Mojolicious | =0.8.4 | |
| Mojolicious | =0.8.5 | |
| Mojolicious | =0.9 | |
| Mojolicious | =0.8006 | |
| Mojolicious | =0.8007 | |
| Mojolicious | =0.8008 | |
| Mojolicious | =0.8009 | |
| Mojolicious | =0.9001 | |
| Mojolicious | =0.9002 | |
| Mojolicious | =0.991231 | |
| Mojolicious | =0.991232 | |
| Mojolicious | =0.991233 | |
| Mojolicious | =0.991234 | |
| Mojolicious | =0.991235 | |
| Mojolicious | =0.991236 | |
| Mojolicious | =0.991237 | |
| Mojolicious | =0.991238 | |
| Mojolicious | =0.991239 | |
| Mojolicious | =0.991240 | |
| Mojolicious | =0.991241 | |
| Mojolicious | =0.991242 | |
| Mojolicious | =0.991243 | |
| Mojolicious | =0.991244 | |
| Mojolicious | =0.991245 | |
| Mojolicious | =0.991246 | |
| Mojolicious | =0.991250 | |
| Mojolicious | =0.991251 | |
| Mojolicious | =0.999901 | |
| Mojolicious | =0.999902 | |
| Mojolicious | =0.999903 | |
| Mojolicious | =0.999904 | |
| Mojolicious | =0.999905 | |
| Mojolicious | =0.999906 | |
| Mojolicious | =0.999907 | |
| Mojolicious | =0.999908 | |
| Mojolicious | =0.999909 | |
| Mojolicious | =0.999910 | |
| Mojolicious | =0.999911 | |
| Mojolicious | =0.999912 | |
| Mojolicious | =0.999913 | |
| Mojolicious | =0.999914 | |
| Mojolicious | =0.999920 | |
| Mojolicious | =0.999921 | |
| Mojolicious | =0.999922 | |
| Mojolicious | =0.999923 | |
| Mojolicious | =0.999924 | |
| Mojolicious | =0.999925 | |
| Mojolicious | =0.999926 | |
| Mojolicious | =0.999927 | |
| Mojolicious | =0.999928 | |
| Mojolicious | =0.999929 | |
| Mojolicious | =0.999930 | |
| Mojolicious | =0.999931 | |
| Mojolicious | =0.999932 | |
| Mojolicious | =0.999933 | |
| Mojolicious | =0.999934 | |
| Mojolicious | =0.999935 | |
| Mojolicious | =0.999936 | |
| Mojolicious | =0.999937 | |
| Mojolicious | =0.999938 | |
| Mojolicious | =0.999939 | |
| Mojolicious | =0.999940 | |
| Mojolicious | =0.999941 | |
| Mojolicious | =0.999950 | |
| Mojolicious | =1.0 | |
| Mojolicious | =1.1 | |
| Mojolicious | =1.01 | |
| Mojolicious | =1.11 | |
| Mojolicious | =1.12 | |
| Mojolicious | =1.13 | |
| Mojolicious | =1.14 | |
| Mojolicious | =1.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://perlninja.posterous.com/sharks-in-the-water
- http://openwall.com/lists/oss-security/2011/04/17/1
- https://bugzilla.redhat.com/show_bug.cgi?id=697229
- http://openwall.com/lists/oss-security/2011/04/18/3
- http://search.cpan.org/CPAN/authors/id/K/KR/KRAIH/Mojolicious-1.16.tar.gz
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952
- http://www.osvdb.org/71850
- http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.16/Changes
- http://openwall.com/lists/oss-security/2011/04/18/7
- http://www.securityfocus.com/bid/47402
- https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818
- https://github.com/kraih/mojo/issues/114
- http://secunia.com/advisories/44051
- http://www.vupen.com/english/advisories/2011/1093
- http://www.vupen.com/english/advisories/2011/1072
- http://secunia.com/advisories/44359
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058885.html
- http://www.debian.org/security/2011/dsa-2221
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058891.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66830
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=697230
- https://access.redhat.com/security/cve/CVE-2011-1589
Frequently Asked Questions
What is the severity of CVE-2011-1589?
CVE-2011-1589 is considered as having moderate severity due to its potential for unauthorized file access.
How do I fix CVE-2011-1589?
To fix CVE-2011-1589, upgrade to Mojolicious version 1.17 or later where the vulnerability has been patched.
What versions of Mojolicious are affected by CVE-2011-1589?
CVE-2011-1589 affects Mojolicious versions including 0.8007 and up to 1.0, before the fix in version 1.17.
What type of vulnerability is CVE-2011-1589?
CVE-2011-1589 is a directory traversal vulnerability that allows unauthorized file access.
Are there any known exploits for CVE-2011-1589?
Yes, CVE-2011-1589 could potentially be exploited to access arbitrary files by manipulating URL paths.
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/remedy
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-1589
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/mojolicious
- canonical/mojolicious
- version/mojolicious/0.2
- version/mojolicious/0.3
- version/mojolicious/0.4
- version/mojolicious/0.5
- version/mojolicious/0.6
- version/mojolicious/0.7
- version/mojolicious/0.8
- version/mojolicious/0.8.1
- version/mojolicious/0.8.2
- version/mojolicious/0.8.3
- version/mojolicious/0.8.4
- version/mojolicious/0.8.5
- version/mojolicious/0.9
- version/mojolicious/0.8006
- version/mojolicious/0.8007
- version/mojolicious/0.8008
- version/mojolicious/0.8009
- version/mojolicious/0.9001
- version/mojolicious/0.9002
- version/mojolicious/0.991231
- version/mojolicious/0.991232
- version/mojolicious/0.991233
- version/mojolicious/0.991234
- version/mojolicious/0.991235
- version/mojolicious/0.991236
- version/mojolicious/0.991237
- version/mojolicious/0.991238
- version/mojolicious/0.991239
- version/mojolicious/0.991240
- version/mojolicious/0.991241
- version/mojolicious/0.991242
- version/mojolicious/0.991243
- version/mojolicious/0.991244
- version/mojolicious/0.991245
- version/mojolicious/0.991246
- version/mojolicious/0.991250
- version/mojolicious/0.991251
- version/mojolicious/0.999901
- version/mojolicious/0.999902
- version/mojolicious/0.999903
- version/mojolicious/0.999904
- version/mojolicious/0.999905
- version/mojolicious/0.999906
- version/mojolicious/0.999907
- version/mojolicious/0.999908
- version/mojolicious/0.999909
- version/mojolicious/0.999910
- version/mojolicious/0.999911
- version/mojolicious/0.999912
- version/mojolicious/0.999913
- version/mojolicious/0.999914
- version/mojolicious/0.999920
- version/mojolicious/0.999921
- version/mojolicious/0.999922
- version/mojolicious/0.999923
- version/mojolicious/0.999924
- version/mojolicious/0.999925
- version/mojolicious/0.999926
- version/mojolicious/0.999927
- version/mojolicious/0.999928
- version/mojolicious/0.999929
- version/mojolicious/0.999930
- version/mojolicious/0.999931
- version/mojolicious/0.999932
- version/mojolicious/0.999933
- version/mojolicious/0.999934
- version/mojolicious/0.999935
- version/mojolicious/0.999936
- version/mojolicious/0.999937
- version/mojolicious/0.999938
- version/mojolicious/0.999939
- version/mojolicious/0.999940
- version/mojolicious/0.999941
- version/mojolicious/0.999950
- version/mojolicious/1.0
- version/mojolicious/1.1
- version/mojolicious/1.01
- version/mojolicious/1.11
- version/mojolicious/1.12
- version/mojolicious/1.13
- version/mojolicious/1.14
- version/mojolicious/1.15