Mô tả CVE

Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.

Thông tin CVE

Điểm yếu liên quan

CWE-ID	Tên điểm yếu	Nguồn
CWE-22	Improper Limitation of a Pathname to a Restricted Directory The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Số liệu

Số liệu	Điểm	Mức độ nghiêm trọng	CVSS Vector	Nguồn
V2	5		AV:N/AC:L/Au:N/C:P/I:N/A:N	nvd@nist.gov

EPSS

EPSS là mô hình tính điểm dự đoán khả năng một lỗ hổng bị khai thác.

Điểm EPSS

Mô hình EPSS tạo ra điểm xác suất từ 0 đến 1 (0 đến 100%). Điểm càng cao, xác suất một lỗ hổng bị khai thác càng lớn.

Phân vị EPSS

Phân vị được dùng để xếp hạng CVE theo điểm EPSS. Ví dụ, một CVE ở phân vị thứ 95 theo điểm EPSS có nhiều khả năng bị khai thác hơn 95% CVE khác. Do đó, phân vị được dùng để so sánh điểm EPSS của một CVE với các CVE khác.

EPSS First.org

Sản phẩm được đề cập

Cấu hình 0

Mojolicious>>Mojolicious >> Version 0.2

Mojolicious>>Mojolicious >> Version 0.3

Mojolicious>>Mojolicious >> Version 0.4

Mojolicious>>Mojolicious >> Version 0.5

Mojolicious>>Mojolicious >> Version 0.6

Mojolicious>>Mojolicious >> Version 0.7

Mojolicious>>Mojolicious >> Version 0.8

Mojolicious>>Mojolicious >> Version 0.8.1

Mojolicious>>Mojolicious >> Version 0.8.2

Mojolicious>>Mojolicious >> Version 0.8.3

Mojolicious>>Mojolicious >> Version 0.8.4

Mojolicious>>Mojolicious >> Version 0.8.5

Mojolicious>>Mojolicious >> Version 0.9

Mojolicious>>Mojolicious >> Version 0.8006

Mojolicious>>Mojolicious >> Version 0.8007

Mojolicious>>Mojolicious >> Version 0.8008

Mojolicious>>Mojolicious >> Version 0.8009

Mojolicious>>Mojolicious >> Version 0.9001

Mojolicious>>Mojolicious >> Version 0.9002

Mojolicious>>Mojolicious >> Version 0.991231

Mojolicious>>Mojolicious >> Version 0.991232

Mojolicious>>Mojolicious >> Version 0.991233

Mojolicious>>Mojolicious >> Version 0.991234

Mojolicious>>Mojolicious >> Version 0.991235

Mojolicious>>Mojolicious >> Version 0.991236

Mojolicious>>Mojolicious >> Version 0.991237

Mojolicious>>Mojolicious >> Version 0.991238

Mojolicious>>Mojolicious >> Version 0.991239

Mojolicious>>Mojolicious >> Version 0.991240

Mojolicious>>Mojolicious >> Version 0.991241

Mojolicious>>Mojolicious >> Version 0.991242

Mojolicious>>Mojolicious >> Version 0.991243

Mojolicious>>Mojolicious >> Version 0.991244

Mojolicious>>Mojolicious >> Version 0.991245

Mojolicious>>Mojolicious >> Version 0.991246

Mojolicious>>Mojolicious >> Version 0.991250

Mojolicious>>Mojolicious >> Version 0.991251

Mojolicious>>Mojolicious >> Version 0.999901

Mojolicious>>Mojolicious >> Version 0.999902

Mojolicious>>Mojolicious >> Version 0.999903

Mojolicious>>Mojolicious >> Version 0.999904

Mojolicious>>Mojolicious >> Version 0.999905

Mojolicious>>Mojolicious >> Version 0.999906

Mojolicious>>Mojolicious >> Version 0.999907

Mojolicious>>Mojolicious >> Version 0.999908

Mojolicious>>Mojolicious >> Version 0.999909

Mojolicious>>Mojolicious >> Version 0.999910

Mojolicious>>Mojolicious >> Version 0.999911

Mojolicious>>Mojolicious >> Version 0.999912

Mojolicious>>Mojolicious >> Version 0.999913

Mojolicious>>Mojolicious >> Version 0.999914

Mojolicious>>Mojolicious >> Version 0.999920

Mojolicious>>Mojolicious >> Version 0.999921

Mojolicious>>Mojolicious >> Version 0.999922

Mojolicious>>Mojolicious >> Version 0.999923

Mojolicious>>Mojolicious >> Version 0.999924

Mojolicious>>Mojolicious >> Version 0.999925

Mojolicious>>Mojolicious >> Version 0.999926

Mojolicious>>Mojolicious >> Version 0.999927

Mojolicious>>Mojolicious >> Version 0.999928

Mojolicious>>Mojolicious >> Version 0.999929

Mojolicious>>Mojolicious >> Version 0.999930

Mojolicious>>Mojolicious >> Version 0.999931

Mojolicious>>Mojolicious >> Version 0.999932

Mojolicious>>Mojolicious >> Version 0.999933

Mojolicious>>Mojolicious >> Version 0.999934

Mojolicious>>Mojolicious >> Version 0.999935

Mojolicious>>Mojolicious >> Version 0.999936

Mojolicious>>Mojolicious >> Version 0.999937

Mojolicious>>Mojolicious >> Version 0.999938

Mojolicious>>Mojolicious >> Version 0.999939

Mojolicious>>Mojolicious >> Version 0.999940

Mojolicious>>Mojolicious >> Version 0.999941

Mojolicious>>Mojolicious >> Version 0.999950

Mojolicious>>Mojolicious >> Version 1.0

Mojolicious>>Mojolicious >> Version 1.1

Mojolicious>>Mojolicious >> Version 1.01

Mojolicious>>Mojolicious >> Version 1.11

Mojolicious>>Mojolicious >> Version 1.12

Mojolicious>>Mojolicious >> Version 1.13

Mojolicious>>Mojolicious >> Version 1.14

Mojolicious>>Mojolicious >> Version 1.15

Tài liệu tham khảo

http://perlninja.posterous.com/sharks-in-the-water
Tags : x_refsource_MISC

http://www.debian.org/security/2011/dsa-2221
Tags : vendor-advisory, x_refsource_DEBIAN

http://search.cpan.org/CPAN/authors/id/K/KR/KRAIH/Mojolicious-1.16.tar.gz
Tags : x_refsource_CONFIRM

http://www.vupen.com/english/advisories/2011/1072
Tags : vdb-entry, x_refsource_VUPEN

https://github.com/kraih/mojo/issues/114
Tags : x_refsource_CONFIRM

http://openwall.com/lists/oss-security/2011/04/18/7
Tags : mailing-list, x_refsource_MLIST

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058891.html
Tags : vendor-advisory, x_refsource_FEDORA

http://secunia.com/advisories/44359
Tags : third-party-advisory, x_refsource_SECUNIA

https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818
Tags : x_refsource_CONFIRM

http://secunia.com/advisories/44051
Tags : third-party-advisory, x_refsource_SECUNIA

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622952
Tags : x_refsource_CONFIRM

http://www.vupen.com/english/advisories/2011/1093
Tags : vdb-entry, x_refsource_VUPEN

http://www.osvdb.org/71850
Tags : vdb-entry, x_refsource_OSVDB

http://openwall.com/lists/oss-security/2011/04/17/1
Tags : mailing-list, x_refsource_MLIST

http://www.securityfocus.com/bid/47402
Tags : vdb-entry, x_refsource_BID

http://cpansearch.perl.org/src/KRAIH/Mojolicious-1.16/Changes
Tags : x_refsource_CONFIRM

https://exchange.xforce.ibmcloud.com/vulnerabilities/66830
Tags : vdb-entry, x_refsource_XF

http://openwall.com/lists/oss-security/2011/04/18/3
Tags : mailing-list, x_refsource_MLIST

https://bugzilla.redhat.com/show_bug.cgi?id=697229
Tags : x_refsource_CONFIRM

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058885.html
Tags : vendor-advisory, x_refsource_FEDORA

Ngày	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	4.36%	–	–
2022-04-03	–	–	4.36%	–	–
2022-09-25	–	–	4.36%	–	–
2023-03-12	–	–	–	1.03%	–
2023-05-21	–	–	–	1.18%	–
2023-11-05	–	–	–	1.18%	–
2023-11-12	–	–	–	1.18%	–
2024-01-14	–	–	–	1.18%	–
2024-02-11	–	–	–	1.18%	–
2024-06-02	–	–	–	1.18%	–
2024-06-02	–	–	–	1.18%	–
2024-11-03	–	–	–	1.18%	–
2024-12-22	–	–	–	1.19%	–
2025-01-19	–	–	–	1.19%	–
2025-03-18	–	–	–	–	1.21%
2025-03-30	–	–	–	–	2.11%
2025-10-01	–	–	–	–	2.11%
2025-10-04	–	–	–	–	2.11%
2025-10-27	–	–	–	–	2.11%
2025-10-28	–	–	–	–	2.11%
2025-10-31	–	–	–	–	2.11%
2025-11-18	–	–	–	–	2.11%
2025-11-21	–	–	–	–	2.11%
2026-06-14	–	–	–	–	2.11%

Ngày	Phân vị
2022-02-06	71%
2022-04-03	87%
2022-09-25	88%
2023-03-12	82%
2023-05-21	83%
2023-11-05	84%
2023-11-12	83%
2024-01-14	84%
2024-02-11	85%
2024-06-02	85%
2024-06-02	85%
2024-11-03	86%
2024-12-22	85%
2025-01-19	85%
2025-03-18	78%
2025-03-30	83%
2025-10-01	84%
2025-10-04	83%
2025-10-27	84%
2025-10-28	83%
2025-10-31	84%
2025-11-18	83%
2025-11-21	84%
2026-06-14	85%

CVE-2011-1589 : Chi tiết

CVE-2011-1589