Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component
The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-1505US | critical10.0 | — | ||
The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore. | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2016/01/05/7WEB
- http://www.openwall.com/lists/oss-security/2016/01/06/4WEB
- http://www.openwall.com/lists/oss-security/2016/01/06/7WEB
- http://www.openwall.com/lists/oss-security/2016/01/07/7WEB
- http://www.securityfocus.com/bid/80255WEB
- https://github.com/Kozea/RadicalePACKAGE
- https://github.com/Kozea/Radicale/commit/b4b3d51f33c7623d312f289252dd7bbb8f58bbe6WEB
- https://github.com/Kozea/Radicale/pull/343WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan