Description

Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences.

Remediation

References

CVE-2005-0202

Related Vulnerabilities

Drupal Core 4.7.x Cross-Site Scripting (4.7.0 - 4.7.1)

WordPress Plugin Defender Security-Malware Scanner, Login Security & Firewall Cross-Site Request Forgery (2.4.6)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-11023)

XWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-36477)

Oracle Application Server Other Vulnerability (CVE-2006-3708)

Severity

Medium

Classification

CVE-2005-0202

Tags

Missing Update Known Vulnerabilities