This affects the package Crow before 0.3+4. It is possible to traverse directories to fetch arbitrary files from the server.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCrowcpp Crow
APPCrowcpp< 0.3\+4
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path Traversal
CWE
Powiązane podatności
CVE-2022-38667CRITICAL9.8ten sam produkt
HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTT...
CVE-2022-34970CRITICAL9.8ten sam produkt
Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful ...
CVE-2022-38668HIGH7.5ten sam produkt
HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data fr...
CVE-2023-26142MEDIUM6.5ten sam produkt
All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used t...
CVE-2021-23824MEDIUM6.5ten sam produkt
This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker ...