CVE-2011-1589: Path Traversal
A directory traversal flaw was found in Mojolicious [1]. Because Mojolicious did not unescape paths before processing them, a user could use it to view arbitrary files using '%2f' rather than '/' (for example: %2f..%2f). This has been corrected in upstream version 1.17 [2].
[1] https://github.com/kraih/mojo/issues/114 [2] https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818
Other sources
Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1589?
CVE-2011-1589 is considered as having moderate severity due to its potential for unauthorized file access.
How do I fix CVE-2011-1589?
To fix CVE-2011-1589, upgrade to Mojolicious version 1.17 or later where the vulnerability has been patched.
What versions of Mojolicious are affected by CVE-2011-1589?
CVE-2011-1589 affects Mojolicious versions including 0.8007 and up to 1.0, before the fix in version 1.17.
What type of vulnerability is CVE-2011-1589?
CVE-2011-1589 is a directory traversal vulnerability that allows unauthorized file access.
Are there any known exploits for CVE-2011-1589?
Yes, CVE-2011-1589 could potentially be exploited to access arbitrary files by manipulating URL paths.