CVE-2022-35920

Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` if using encoded `%2F` URLs. Parent directory traversal is not impacted. Users are advised to upgrade. There is no known workaround for this issue.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
GitHub_MCNA
8.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
VendorProductVersion
sanic_projectsanic
𝑥
< 20.12.7
sanic_projectsanic
21.0.0 ≤
𝑥
< 21.12.2
sanic_projectsanic
22.0.0 ≤
𝑥
< 22.6.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/sanic-org/sanic/issues/2478
https://github.com/sanic-org/sanic/pull/2495
https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6
https://github.com/sanic-org/sanic/issues/2478
https://github.com/sanic-org/sanic/pull/2495
https://github.com/sanic-org/sanic/security/advisories/GHSA-8cw9-5hmv-77w6