CVE:CVE-2006-0847
CNNVD:CNNVD-200602-322
CherryPy 2.1.1之前版本的staticfilter组件中存在目录遍历漏洞。远程攻击者可以借助未明向量中的".."序列读取任意文件。
solution:Upgrade cherrypy cherrypy to a higher version than 0.1,0.2,0.3,0.4,0.5,0.6,0.7,0.8,0.8_beta,0.9,0.9_beta,0.9_gamma,0.9_rc1,0.10,0.10_beta,0.10_rc1,2.0.0,2.0.0a1,2.1.0,2.1.0_beta,2.1.0_rc1,2.1.0_rc2,and avoid the version 0.1,0.2,0.3,0.4,0.5,0.6,0.7,0.8,0.8_beta,0.9,0.9_beta,0.9_gamma,0.9_rc1,0.10,0.10_beta,0.10_rc1,2.0.0,2.0.0a1,2.1.0,2.1.0_beta,2.1.0_rc1,2.1.0_rc2