Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-mt93-hcnp-13ah
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.
Aliases
0
alias CVE-2023-29200
1
alias GHSA-fp7q-xhhw-6rj3
Fixed_packages
0
url pkg:composer/contao/contao@4.9.40
purl pkg:composer/contao/contao@4.9.40
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.9.40
1
url pkg:composer/contao/contao@4.13.21
purl pkg:composer/contao/contao@4.13.21
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.13.21
2
url pkg:composer/contao/contao@5.1.4
purl pkg:composer/contao/contao@5.1.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@5.1.4
3
url pkg:composer/contao/core-bundle@4.9.40
purl pkg:composer/contao/core-bundle@4.9.40
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.9.40
4
url pkg:composer/contao/core-bundle@4.13.21
purl pkg:composer/contao/core-bundle@4.13.21
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.13.21
5
url pkg:composer/contao/core-bundle@5.1.4
purl pkg:composer/contao/core-bundle@5.1.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@5.1.4
Affected_packages
0
url pkg:composer/contao/contao@4.9.0
purl pkg:composer/contao/contao@4.9.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-mt93-hcnp-13ah
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.9.0
1
url pkg:composer/contao/contao@4.13.0
purl pkg:composer/contao/contao@4.13.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-mt93-hcnp-13ah
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.13.0
2
url pkg:composer/contao/contao@5.1.0
purl pkg:composer/contao/contao@5.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-mt93-hcnp-13ah
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@5.1.0
3
url pkg:composer/contao/core-bundle@2.0.0
purl pkg:composer/contao/core-bundle@2.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-mt93-hcnp-13ah
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@2.0.0
4
url pkg:composer/contao/core-bundle@4.10.0
purl pkg:composer/contao/core-bundle@4.10.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-82d1-8yn8-sydv
1
vulnerability VCID-azpb-eq6c-e7bw
2
vulnerability VCID-mt93-hcnp-13ah
3
vulnerability VCID-nepv-9985-37g4
4
vulnerability VCID-rj3d-jeyz-vye5
5
vulnerability VCID-t2u3-tgg3-cbb9
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.10.0
5
url pkg:composer/contao/core-bundle@5.0.0
purl pkg:composer/contao/core-bundle@5.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-mt93-hcnp-13ah
1
vulnerability VCID-nepv-9985-37g4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@5.0.0
References
0
reference_url https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager
reference_id
reference_type
scores
url https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager
1
reference_url https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager.html
reference_id
reference_type
scores
url https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager.html
2
reference_url https://github.com/contao/contao/commit/6f3e705f4ff23f4419563d09d8485793569f31df
reference_id
reference_type
scores
url https://github.com/contao/contao/commit/6f3e705f4ff23f4419563d09d8485793569f31df
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-29200
reference_id CVE-2023-29200
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-29200
4
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2023-29200.yaml
reference_id CVE-2023-29200.YAML
reference_type
scores
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2023-29200.yaml
5
reference_url https://github.com/advisories/GHSA-fp7q-xhhw-6rj3
reference_id GHSA-fp7q-xhhw-6rj3
reference_type
scores
url https://github.com/advisories/GHSA-fp7q-xhhw-6rj3
6
reference_url https://github.com/contao/contao/security/advisories/GHSA-fp7q-xhhw-6rj3
reference_id GHSA-fp7q-xhhw-6rj3
reference_type
scores
url https://github.com/contao/contao/security/advisories/GHSA-fp7q-xhhw-6rj3
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 22
name Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
Severity_range_scorenull
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-mt93-hcnp-13ah