Home > Vulnerability Database > CVE-2015-8309

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2015-8309

Good to know:

Date: March 27, 2017

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."

Language: Python

Severity Score

4.3

Related Resources (7)

Url: http://www.securityfocus.com/bid/97149

Url: https://github.com/devsnd/cherrymusic/issues/598

Url: https://nvd.nist.gov/vuln/detail/CVE-2015-8309

Url: https://github.com/devsnd/cherrymusic/commit/62dec34a1ea0741400dd6b6c660d303dcd651e86

Url: http://www.fomori.org/cherrymusic/Changes.html

Url: https://www.exploit-db.com/exploits/40361/

Url: https://www.mend.io/vulnerability-database/CVE-2015-8309

Severity Score

4.3

Weakness Type (CWE)

Path Traversal

CWE-22

Top Fix

Upgrade Version

Upgrade to version 0.36.0

CVSS v3

Base Score:	4.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	4.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	SINGLE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Do you need more information?

Contact Us