Cherry Music directory traversal vulnerability

MEDIO 4.3CVE-2015-8309 · GHSA-q624-9634-77gh · PYSEC-2017-99 · Published 27/03/2017 · updated 17/06/2026

In breve

CVE-2015-8309 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda cherrymusic, cherrymusic (fomori).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 6.7%, superiore al 93.9% delle vulnerabilità.
Correzione: aggiornare a 0.36.0 o successiva.

Package	Affected versions	Patched versions
cherrymusic PyPI	`< 0.36.0`	`0.36.0`
cherrymusic fomori	`≤ 0.35.2`	No fix yet

Description

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."

NVD description

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."

References

nvd.nist.gov/vuln/detail/CVE-2015-8309 · ADVISORY
devsnd/cherrymusic · WEB
devsnd/cherrymusic commit 62dec34 · WEB
devsnd/cherrymusic · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20200227183321/http://www.securityfocus.com/bid/97149 · WEB
exploit-db.com/exploits/40361 · WEB
fomori.org/cherrymusic/Changes.html · WEB
securityfocus.com/bid/97149
exploit-db.com/exploits/40361 · Exploit
GitHub Advisory GHSA-q624-9634-77gh · ADVISORY

Altre vulnerabilità di cherrymusic

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cherrymusic

PyPI

< 0.36.0

0.36.0

cherrymusic

fomori

≤ 0.35.2

No fix yet

Description

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."

NVD description

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."