What is GHSA-qppg-v75c-r5ff?

GHSA-qppg-v75c-r5ff is a security advisory published by GitHub Security Advisories with Medium severity. S3Scanner allows Directory Traversal

Which CVE IDs does GHSA-qppg-v75c-r5ff cover?

GHSA-qppg-v75c-r5ff covers the following CVE IDs: CVE-2021-32061. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qppg-v75c-r5ff?

GHSA-qppg-v75c-r5ff has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-qppg-v75c-r5ff?

GHSA-qppg-v75c-r5ff affects 1 product, including: pip/s3scanner:\u003c 2.0.2.

GHSA-qppg-v75c-r5ffMediumCVSS 5.3

S3Scanner allows Directory Traversal

Vendor

GitHub Security Advisories

Published

November 30, 2021

Last Modified

October 26, 2024

🔗 CVE IDs covered (1)

CVE-2021-32061 →

📋 Description

S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult element.

🎯 Affected products1

pip/s3scanner:< 2.0.2

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2021-32061
https://github.com/sa7mon/S3Scanner/issues/122
https://github.com/sa7mon/S3Scanner/releases/tag/2.0.2
https://vuln.ryotak.me/advisories/62
https://github.com/sa7mon/S3Scanner/commit/fafa30a3bd35b496b3f7db9bfc35b75a8a06bcd1
https://github.com/advisories/GHSA-qppg-v75c-r5ff
https://github.com/pypa/advisory-database/tree/main/vulns/s3scanner/PYSEC-2021-433.yaml