GHSA-27px-qpmj-qg38

Suggest an improvement
Source
https://github.com/advisories/GHSA-27px-qpmj-qg38
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-27px-qpmj-qg38/GHSA-27px-qpmj-qg38.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-27px-qpmj-qg38
Aliases
Published
2022-05-17T05:12:26Z
Modified
2024-11-29T05:28:45.396577Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Paste Script has improper group memberships permissions
Details

Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.

Database specific 
{
    "nvd_published_at": "2012-05-01T19:55:00Z",
    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-30T14:42:19Z"
}
References

Affected packages

PyPI / pastescript

Package

Name
pastescript
View open source insights on deps.dev
Purl
pkg:pypi/pastescript

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.1

Affected versions

0.*

0.3
0.3.1
0.4
0.4.1
0.4.2
0.5
0.5.1
0.9
0.9.6
0.9.7
0.9.8

1.*

1.0
1.1
1.3
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.6
1.6.1
1.6.1.1
1.6.2
1.6.3
1.7
1.7.2
1.7.3
1.7.4
1.7.4.1
1.7.4.2
1.7.5

2.*

2.0

PyPI / paste

Package

Name
paste
View open source insights on deps.dev
Purl
pkg:pypi/paste

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.7.5.1

Affected versions

0.*

0.3
0.4
0.4.1
0.5
0.9
0.9.1
0.9.2
0.9.3
0.9.5
0.9.6
0.9.7
0.9.8
0.9.8.1

1.*

1.0
1.0.1
1.1
1.1.1
1.2
1.2.1
1.3
1.4
1.4.1
1.4.2
1.5
1.5.1
1.6
1.7
1.7.1
1.7.2
1.7.3
1.7.3.1
1.7.4
1.7.5