GitHub Advisoryadvisory · PyPI

GHSA-6w8c-6jrg-qwj2 Radicale regex metacharacters injection in the user name

MEDIUM Published 2022-05-17 Modified 2024-10-16 Official page ↗
Aliases
CVE-2015-8748
Ecosystem
PyPI
Packages
Radicale
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-74
Reviewed
2024-04-29

Affected packages

• PyPI Radicale: < 1.1 → fixed in 1.1

Description

Radicale before 1.1 allows remote authenticated users to bypass `owner_write` and `owner_only` limitations via regex metacharacters in the user name, as demonstrated by `.*`.

Related

Alias · CVE (1)

  • CVE-2015-8748 Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References