GitHub Advisoryadvisory · PyPI

GHSA-h454-rq3m-89rc Wagtail CRX CodeRed Extensions vulnerable to Path Traversal

MEDIUM Published 2023-10-22 Modified 2023-10-31 Official page ↗
Aliases
CVE-2021-46897
Ecosystem
PyPI
Packages
coderedcms
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-10-24

Affected packages

• PyPI coderedcms: < 0.22.3 → fixed in 0.22.3

Description

views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traversal when serving protected media.

Related

Alias · CVE (1)

  • CVE-2021-46897 views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References