CVE-2022-35920
8.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Summary
Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using app.static if using encoded %2F URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| sanic-org | sanic | >= 22.0.0, < 22.6.1 | affected |
| sanic-org | sanic | >= 21.0.0, < 21.12.2 | affected |
| sanic-org | sanic | < 20.12.7 | affected |
Weaknesses
- CWE-22: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
ADP Enrichment
CVE Program Container
Additional References
- https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6
- https://github.com/sanic-org/sanic/issues/2478
- https://github.com/sanic-org/sanic/pull/2495
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: yes
- Technical Impact: partial
References
- https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6
- https://github.com/sanic-org/sanic/issues/2478
- https://github.com/sanic-org/sanic/pull/2495
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.