CVE-2011-4211
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWED_MODES and ALLOWED_DIRS changes within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.
La implementación FakeFile en el entorno de ejecución controlada en Google App Engine Python SDK anterior a v1.5.4 no controla adecuadamente la apertura de archivos, que permite a usuarios locales eludir restricciones de acceso y crear archivos de su elección a través de ALLOWED_MODES y cambios ALLOWED_DIRS dentro del parámetro "code" en _ah/admin/interactive/Execute, una vulnerabilidad diferente a CVE-2011-1364.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2011-10-30 CVE Reserved
- 2011-10-30 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/50464 | Vdb Entry | |
https://exchange.xforce.ibmcloud.com/vulnerabilities/71064 | Vdb Entry |
URL | Date | SRC |
---|---|---|
http://blog.watchfire.com/files/googleappenginesdk.pdf | 2024-08-07 |
URL | Date | SRC |
---|---|---|
http://code.google.com/p/googleappengine/wiki/SdkReleaseNotes | 2017-08-29 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | <= 1.5.3 Search vendor "Google" for product "App Engine Python Sdk" and version " <= 1.5.3" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.0.1 Search vendor "Google" for product "App Engine Python Sdk" and version "1.0.1" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.0.2 Search vendor "Google" for product "App Engine Python Sdk" and version "1.0.2" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.1.0 Search vendor "Google" for product "App Engine Python Sdk" and version "1.1.0" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.1.1 Search vendor "Google" for product "App Engine Python Sdk" and version "1.1.1" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.1.2 Search vendor "Google" for product "App Engine Python Sdk" and version "1.1.2" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.1.3 Search vendor "Google" for product "App Engine Python Sdk" and version "1.1.3" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.1.4 Search vendor "Google" for product "App Engine Python Sdk" and version "1.1.4" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.1.5 Search vendor "Google" for product "App Engine Python Sdk" and version "1.1.5" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.1.6 Search vendor "Google" for product "App Engine Python Sdk" and version "1.1.6" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.1.7 Search vendor "Google" for product "App Engine Python Sdk" and version "1.1.7" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.1.8 Search vendor "Google" for product "App Engine Python Sdk" and version "1.1.8" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.1.9 Search vendor "Google" for product "App Engine Python Sdk" and version "1.1.9" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.2.0 Search vendor "Google" for product "App Engine Python Sdk" and version "1.2.0" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.2.1 Search vendor "Google" for product "App Engine Python Sdk" and version "1.2.1" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.2.2 Search vendor "Google" for product "App Engine Python Sdk" and version "1.2.2" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.2.3 Search vendor "Google" for product "App Engine Python Sdk" and version "1.2.3" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.2.4 Search vendor "Google" for product "App Engine Python Sdk" and version "1.2.4" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.2.5 Search vendor "Google" for product "App Engine Python Sdk" and version "1.2.5" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.2.6 Search vendor "Google" for product "App Engine Python Sdk" and version "1.2.6" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.2.7 Search vendor "Google" for product "App Engine Python Sdk" and version "1.2.7" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.3.0 Search vendor "Google" for product "App Engine Python Sdk" and version "1.3.0" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.3.1 Search vendor "Google" for product "App Engine Python Sdk" and version "1.3.1" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.3.2 Search vendor "Google" for product "App Engine Python Sdk" and version "1.3.2" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.3.3 Search vendor "Google" for product "App Engine Python Sdk" and version "1.3.3" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.3.4 Search vendor "Google" for product "App Engine Python Sdk" and version "1.3.4" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.3.5 Search vendor "Google" for product "App Engine Python Sdk" and version "1.3.5" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.3.6 Search vendor "Google" for product "App Engine Python Sdk" and version "1.3.6" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.3.7 Search vendor "Google" for product "App Engine Python Sdk" and version "1.3.7" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.3.8 Search vendor "Google" for product "App Engine Python Sdk" and version "1.3.8" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.4.0 Search vendor "Google" for product "App Engine Python Sdk" and version "1.4.0" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.4.1 Search vendor "Google" for product "App Engine Python Sdk" and version "1.4.1" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.4.2 Search vendor "Google" for product "App Engine Python Sdk" and version "1.4.2" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.4.3 Search vendor "Google" for product "App Engine Python Sdk" and version "1.4.3" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.5.0 Search vendor "Google" for product "App Engine Python Sdk" and version "1.5.0" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.5.1 Search vendor "Google" for product "App Engine Python Sdk" and version "1.5.1" | - |
Affected
| ||||||
Google Search vendor "Google" | App Engine Python Sdk Search vendor "Google" for product "App Engine Python Sdk" | 1.5.2 Search vendor "Google" for product "App Engine Python Sdk" and version "1.5.2" | - |
Affected
|