CVE-2008-6547 FormEncode Access Restrictions Bypass
Attackers can bypass intended access restrictions in FormEncode by exploiting a failure to apply chained validators, requiring the feature to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not stated
- Fix
- Available
What is CVE-2008-6547?
CVE-2008-6547 is a high-severity vulnerability in n/a, published on 30 Mar 2009. It can be exploited over the network.
Official description
schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.
Weakness: CWE-20
Which versions are affected by CVE-2008-6547?
3 open source packages ship an affected version, including formencode and FormEncode. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
formencode PyPI | All versions | 1.0.1 |
formencode PyPI | From 1.0 | 1.0.1 |
FormEncode PyPI | From 1.0 | 1.0.1 |
Products include Formencode Formencode.
How do I fix CVE-2008-6547?
Upgrade formencode to 1.0.1 or later.
Is CVE-2008-6547 being exploited?
There is no known exploitation of CVE-2008-6547 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2008-6547, GHSA-9jp4-68vc-r8wq, PYSEC-2009-5.