** DISPUTED ** The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1.
References
| Link | Resource |
|---|---|
| https://github.com/nisdn/CVE-2021-40978 | Exploit Third Party Advisory |
| https://github.com/mkdocs/mkdocs | Third Party Advisory |
| https://github.com/nisdn/CVE-2021-40978/issues/1 | Issue Tracking Third Party Advisory |
| https://github.com/mkdocs/mkdocs/issues/2601 | Issue Tracking Third Party Advisory |
Advertisement
Configurations
Information
Published : 2021-10-07 07:15
Updated : 2021-10-15 05:18
NVD link : CVE-2021-40978
Mitre link : CVE-2021-40978
JSON object : View
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Advertisement
Products Affected
mkdocs
- mkdocs