CVE-2015-8747: Input Validation

Q: Who is exposed to this issue?

Radicale deployments using the multifilesystem storage backend are exposed if they run a version before 1.1. The vulnerability is remotely reachable and does not require authentication or user interaction.

Q: What does an attacker need to exploit it?

An attacker needs network access to the affected Radicale service and must send a crafted component name. Successful exploitation can allow reading from or writing to arbitrary files.

Q: Are default deployments affected?

The provided information identifies the multifilesystem storage backend as the affected component, but does not state whether that backend is enabled by default.

Q: How can this be remediated?

Apply the available patch by upgrading Radicale to version 1.1 or later. The supplied data does not provide an alternative mitigation for systems that cannot be patched immediately.

Published Feb 3, 2016

Updated

The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.

Affected Software

2 affected componentsFixes available

pip/Radicale<1.1

1.1

Radicale Radicale<=1.0.1

Remediation

Patch Available

https://github.com/Kozea/Radicale/pull/343

Event History

Feb 3, 2016

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

May 17, 2022

Advisory Published

via GitHub·03:29 AM

Frequently Asked Questions

Who is exposed to this issue?

Radicale deployments using the multifilesystem storage backend are exposed if they run a version before 1.1. The vulnerability is remotely reachable and does not require authentication or user interaction.

What does an attacker need to exploit it?

An attacker needs network access to the affected Radicale service and must send a crafted component name. Successful exploitation can allow reading from or writing to arbitrary files.

Are default deployments affected?

The provided information identifies the multifilesystem storage backend as the affected component, but does not state whether that backend is enabled by default.

How can this be remediated?

Apply the available patch by upgrading Radicale to version 1.1 or later. The supplied data does not provide an alternative mitigation for systems that cannot be patched immediately.

CVE-2015-8747: Input Validation

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default deployments affected?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default deployments affected?

How can this be remediated?