CVE-2005-0202
published 2005-05-02CVE-2005-0202: Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via…
PriorityP426medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.86%
85.3th percentile
Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | mailman | — | — |
| gnu | mailman | — | — |
| gnu | mailman | — | — |
| gnu | mailman | — | — |
| gnu | mailman | — | — |
| gnu | mailman | — | — |
| gnu | mailman | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Fixed mailman packages for USN-78-1
vendor_ubuntu·2005-02-17
CVE-2005-0202 Fixed mailman packages for USN-78-1
Title: Fixed mailman packages for USN-78-1
Summary: Fixed mailman packages for USN-78-1
Ubuntu Security Announce USN-78-1 described a path traversal
vulnerability in the "private" module of Mailman. Unfortunately this
updated mailman package was broken so that the "private" module could
not be executed at all any more. The latest package version fixes
this.
We apologize for the inconvenience.
For reference, this is the description of the original USN:
An path traversal vulnerability has been discovered in the "private"
module of Mailman. A flawed path sanitation algorithm allowed the
construction of URLS to arbitrary files readable by Mailman. This
allowed a remote attacker to retrieve configuration and password
databases, private list archives, and other files.
Instructions: In gene
Ubuntu
Mailman vulnerability
vendor_ubuntu·2005-02-10
CVE-2005-0202 Mailman vulnerability
Title: Mailman vulnerability
Summary: Mailman vulnerability
An path traversal vulnerability has been discovered in the "private"
module of Mailman. A flawed path sanitation algorithm allowed the
construction of URLS to arbitrary files readable by Mailman. This
allowed a remote attacker to retrieve configuration and password
databases, private list archives, and other files.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
security flaw
vendor_redhat·2005-02-09·CVSS 5.0
CVE-2005-0202 [MEDIUM] security flaw
security flaw
Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.
GHSA
GHSA-87jx-4wq7-9wr5: Directory traversal vulnerability in the true_path function in private
ghsa_unreviewed·2022-05-01
CVE-2005-0202 [MEDIUM] GHSA-87jx-4wq7-9wr5: Directory traversal vulnerability in the true_path function in private
Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.
No detection rules found.
Bugzilla
CVE-2005-0202 security flaw
bugzilla·2018-08-16·CVSS 5.0
CVE-2005-0202 [MEDIUM] CVE-2005-0202 security flaw
CVE-2005-0202 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.
HackerOne
It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without
hackerone·2017-12-26·CVSS 5.0
CVE-2005-2169 [MEDIUM] It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without
It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without
## Summary
Configuration file and/or source code information leakage without Uber OneLogin SSO authentication.
## Security Impact
Misconfiguration on the server results in information leakage without authentication.
## Reproduction Steps
https://uchat.awscorp.uberinternal.com/static/main.740f5a0b92c00e72e2e1.js
## Specifics
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2169
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0202
* https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion
## Impact
Access to internal configuration files, system names, and source code.
HackerOne
Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication
hackerone·2017-12-26·CVSS 5.0
[MEDIUM] Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication
Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication
## Summary
Configuration file and/or source code information leakage without Uber OneLogin SSO authentication.
## Security Impact
Misconfiguration on the server results in information leakage without authentication.
## Reproduction Steps
https://uchat-staging.uberinternal.com/static/main.740f5a0b92c00e72e2e1.js
## Specifics
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2169
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0202
* https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion
## Impact
Access to internal configuration files, system names, and source code.
CWE
Path Traversal: '.../...//'
mitre_cwe
CWE-35 Path Traversal: '.../...//'
CWE-35: Path Traversal: '.../...//'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Confidentiality, Integrity. Impact: Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism. Not properly neutralizing '.../...//' (doubled triple dot slash) allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security T
CWE
Relative Path Traversal
mitre_cwe
CWE-23 Relative Path Traversal
CWE-23: Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Confidentiality, Availability. Impact: Execute Unauthorized Code or Commands. The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Scope: Integrity. Impact: Modify Files or Directories. The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able
http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031562.htmlhttp://marc.info/?l=bugtraq&m=110805795122386&w=2http://secunia.com/advisories/14211http://securitytracker.com/id?1013145http://www.debian.org/security/2005/dsa-674http://www.gentoo.org/security/en/glsa/glsa-200502-11.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2005:037http://www.novell.com/linux/security/advisories/2005_07_mailman.htmlhttp://www.redhat.com/support/errata/RHSA-2005-136.htmlhttp://www.redhat.com/support/errata/RHSA-2005-137.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10657http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2005-February/031562.htmlhttp://marc.info/?l=bugtraq&m=110805795122386&w=2http://secunia.com/advisories/14211http://securitytracker.com/id?1013145http://www.debian.org/security/2005/dsa-674http://www.gentoo.org/security/en/glsa/glsa-200502-11.xmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2005:037http://www.novell.com/linux/security/advisories/2005_07_mailman.htmlhttp://www.redhat.com/support/errata/RHSA-2005-136.htmlhttp://www.redhat.com/support/errata/RHSA-2005-137.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10657
2005-05-02
Published