Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-7490

CWE-22 — Path Traversal11 documents8 sources
Severity
7.5HIGH
EPSS
93.3%
top 0.19%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Unbit UwsgiDebian Debian Linux
Timeline
PublishedFeb 26
Latest updateMay 14

Description

uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶PyPIuWSGI< 2.0.17
▶PyPIuwsgi< 2.0.17
▶NVDunbit/uwsgi< 2.0.17
▶Debianuwsgi< 2.0.15-10.4+3

Also affects: Debian Linux 8.0, 9.0

🔴Vulnerability Details

4
GHSA
uWSGI Directory Traversal vulnerability↗2022-05-14
▶
OSV
uWSGI Directory Traversal vulnerability↗2022-05-14
▶
OSV
CVE-2018-7490: uWSGI before 2↗2018-02-26
▶
CVEList
CVE-2018-7490: uWSGI before 2↗2018-02-26
▶

💥Exploits & PoCs

2
Exploit-DB
uWSGI < 2.0.17 - Directory Traversal↗2018-03-02
▶
Nuclei
uWSGI PHP Plugin Local File Inclusion
▶

📋Vendor Advisories

1
Debian
CVE-2018-7490: uwsgi - uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-doc...↗2018
▶

💬Community

3
Bugzilla
CVE-2018-7490 uWSGI: Mishandled DOCUMENT_ROOT check with use of --php-docroot option allows for directory traversal↗2018-02-27
▶
Bugzilla
CVE-2018-7490 uWSGI: Mishandled DOCUMENT_ROOT check with use of --php-docroot option allows for directory traversal [epel-all]↗2018-02-27
▶
Bugzilla
CVE-2018-7490 uWSGI: Mishandled DOCUMENT_ROOT check with use of --php-docroot option allows for directory traversal [fedora-all]↗2018-02-27
▶
CVE-2018-7490 (HIGH CVSS 7.5) | uWSGI before 2.0.17 mishandles a DO | cvebase.io