UBUNTU-CVE-2017-9031: Critical severity ubuntu/deluge vulnerability
Published May 17, 2017
·Updated
The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.
Affected Software
1 affected component
ubuntu/deluge*
Event History
May 17, 2017
CVE Published
via OSV·07:29 PM
Data Sourced
via OSV·07:29 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who is exposed to this issue?
Systems running a Deluge version before 1.3.15 with the WebUI component accessible to an attacker are exposed. The supplied vector indicates exploitation can be performed remotely without privileges or user interaction.
2
What should be done to remediate it?
Upgrade Deluge to version 1.3.15 or later. The issue is in the WebUI component, so restricting access to that interface reduces exposure until an upgrade can be completed.
3
How severe is exploitation likely to be?
The provided severity is critical, with a 9.8 score. The vector indicates low attack complexity and potential high impact to confidentiality, integrity, and availability.