Description
Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.
CVSS vector
AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9Complexity: Low
Integrity: None
Availability: None
Affected Packages1 packages
🔴Vulnerability Details
2GHSAGHSA-87jx-4wq7-9wr5: Directory traversal vulnerability in the true_path function in private↗2022-05-01 CVEListCVE-2005-0202: Directory traversal vulnerability in the true_path function in private↗2005-02-09 💥Exploits & PoCs
1Exploit-DBTcpdump - bgp_update_print Remote Denial of Service↗2005-06-09 📋Vendor Advisories
3UbuntuFixed mailman packages for USN-78-1↗2005-02-17 UbuntuMailman vulnerability↗2005-02-10 💬Community
3BugzillaCVE-2005-0202 security flaw↗2018-08-16 HackerOneIt's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without↗2017-12-26 HackerOneConfiguration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication↗2017-12-26