HIGH🇬🇧 English

CVE-2023-29159

CVSS 7.5v3.1pub. 2023-06-01upd. 2025-01-09

Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Encode Starlette

    APP
    Encode
    0.13.5 – 0.27.0 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path TraversalAuth Bypass
CWE
Referencje

Powiązane podatności

CVE-2026-54283HIGH7.5ten sam produkt

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields a...

CVE-2026-48818HIGH7.5ten sam produkt

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vu...

CVE-2024-24762HIGH7.5ten sam produkt

`python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a...

CVE-2023-30798HIGH7.5ten sam produkt

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenti...

CVE-2026-48817MEDIUM5.3ten sam produkt

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HT...