Vulnerability in Plack Project
CVE-2014-5269
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.
EPSS: 0.025 (82.7th percentile) — read the EPSS interpretation.
Affected products
- Plack_project Plack
- N/a — versions n/a
Weakness classification (CWE)
References
- security@debian.org (mailing-list, x_refsource_MLIST)
- security@debian.org (vendor-advisory, x_refsource_FEDORA)
- security@debian.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security@debian.org (x_refsource_OSVDB, vdb-entry)
- security@debian.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security@debian.org (x_refsource_CONFIRM)
- security@debian.org (vendor-advisory, x_refsource_FEDORA)