CVE-2020-15141

· LOWModified

← All CVEs

CVSS v3.1

3.0

EPSS

1.14%

Published

Aug 14, 2020

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Weaknesses (CWE)

CWE-22

Affected Products (1)

openapi-python-client_project · openapi-python-client (up to 0.5.3)vulnerable

References (8)

https://github.com/triaxtec/openapi-python-client/blob/main/CHANGELOG.md#053---2020-08-13

Release NotesThird Party Advisory

https://github.com/triaxtec/openapi-python-client/commit/3e7dfae5d0b3685abf1ede1bc6c086a116ac4746

PatchThird Party Advisory

https://github.com/triaxtec/openapi-python-client/security/advisories/GHSA-7wgr-7666-7pwj

Third Party Advisory

https://pypi.org/project/openapi-python-client

ProductThird Party Advisory