Path Traversal Vulnerability in Flask-Yeoman by Tsileo
CVE-2022-31559

9.3CRITICAL

Key Information:

Vendor

Flask-yeoman Project

Status
Flask-yeoman
Vendor
CVE Published:
11 July 2022

What is CVE-2022-31559?

The Flask-Yeoman project maintained by Tsileo contains a vulnerability that allows for absolute path traversal through improper use of the Flask send_file function. This misconfiguration can lead to unauthorized file access, potentially compromising sensitive information stored on the server. Developers using this repository should update their implementation to ensure that requests do not traverse outside the intended directory paths.

References

https://github.com/github/securitylab/issues/669#issuecom...
x_refsource_MISC

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.