CVE-2021-34363

Katalog CVE

CVSS 9.1 · Critical EPSS 1,8%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada the fuck project the fuck, fedoraproject fedora. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.

Rincian

Terbit di NVD

10 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092 patch · advisory pihak ketiga
• https://github.com/nvbn/thefuck/releases/tag/3.31 release notes · advisory pihak ketiga
• https://vuln.ryotak.me/advisories/48 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4MEDDLBFVRUQH...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YA6UNQSOY6M3N...