Path Traversal

2023-08-2904:05:56

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

path traversal

vulnerability

pyramid

software

static.py

null-byte characters

attacker access

index.html

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

41.6%

JSON

pyramid is vulnerable to Path Traversal. The vulnerability exists because static.py does not properly remove null-byte characters from the path element, which allows an attacker to gain access to index.html located exactly one directory above the location of the static view’s file system path.