GitHub Advisoryadvisory · PyPI

GHSA-qppg-v75c-r5ff S3Scanner allows Directory Traversal

MEDIUM Published 2021-11-30 Modified 2024-10-26 Official page ↗
Aliases
CVE-2021-32061
Ecosystem
PyPI
Packages
s3scanner
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-22
Reviewed
2021-11-30

Affected packages

• PyPI s3scanner: < 2.0.2 → fixed in 2.0.2

Description

S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a `../` substring in a `ListBucketResult` element.

Related

Alias · CVE (1)

  • CVE-2021-32061 S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References