GitHub Advisoryadvisory · PyPI
GHSA-r524-c2gf-5chr Trac reStructuredText breach of privacy and denial of service vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2006-3695
- Ecosystem
- PyPI
- Packages
- trac
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
- Weaknesses
- CWE-200, CWE-400
- Reviewed
- 2024-04-29
Affected packages
• PyPI trac: < 0.9.6 → fixed in 0.9.6
Description
Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows remote attackers to read arbitrary files, perform cross-site scripting (XSS) attacks, or cause a denial of service via unspecified vectors. NOTE: this might be related to CVE-2006-3458.
Related
Alias · CVE (1)
- CVE-2006-3695 Trac before 0.9.6 does not disable the "raw" or "include" commands when providing untrusted users with restructured text (reStructuredText)… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2006-3695 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27706 web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27708 web
- https://github.com/pypa/advisory-database/tree/main/vulns/trac/PYSEC-2006-2.yaml web
- https://web.archive.org/web/20061227230548/http://trac.edgewall.org/wiki/ChangeLog web
- https://web.archive.org/web/20140804165436/http://secunia.com/advisories/21534 web
- https://web.archive.org/web/20140806223337/http://secunia.com/advisories/20958 web
- https://web.archive.org/web/20200228034827/http://www.securityfocus.com/bid/18323 web
- http://trac.edgewall.org/wiki/ChangeLog web
- http://www.debian.org/security/2006/dsa-1152 web