Cherry Music directory traversal vulnerability

MOYENNE 4.3CVE-2015-8309 · GHSA-q624-9634-77gh · PYSEC-2017-99 · Published 27/03/2017 · updated 17/06/2026

En bref

CVE-2015-8309 est une vulnérabilité MOYENNE (CVSS 4.3) touchant cherrymusic, cherrymusic (fomori).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 6.7%, plus élevée que 93.9% des vulnérabilités.
Correctif : mettre à jour vers 0.36.0 ou plus récent.

Package	Affected versions	Patched versions
cherrymusic PyPI	`< 0.36.0`	`0.36.0`
cherrymusic fomori	`≤ 0.35.2`	No fix yet

Description

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."

NVD description

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."

References

nvd.nist.gov/vuln/detail/CVE-2015-8309 · ADVISORY
devsnd/cherrymusic · WEB
devsnd/cherrymusic commit 62dec34 · WEB
devsnd/cherrymusic · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20200227183321/http://www.securityfocus.com/bid/97149 · WEB
exploit-db.com/exploits/40361 · WEB
fomori.org/cherrymusic/Changes.html · WEB
securityfocus.com/bid/97149
exploit-db.com/exploits/40361 · Exploit
GitHub Advisory GHSA-q624-9634-77gh · ADVISORY

Autres vulnérabilités de cherrymusic

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cherrymusic

PyPI

< 0.36.0

0.36.0

cherrymusic

fomori

≤ 0.35.2

No fix yet

Description

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."

NVD description

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."