medium5.3
CVE-2021-32061
S3Scanner allows Directory Traversal
Impact
S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a `<Key>../` substring in a `ListBucketResult` element.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | s3scanner | < 2.0.2 | 2.0.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| S3scanner Project | S3scanner | before 2.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sa7mon/S3Scanner/issues/122
- https://github.com/sa7mon/S3Scanner/releases/tag/2.0.2
- https://vuln.ryotak.me/advisories/62
- https://github.com/advisories/GHSA-qppg-v75c-r5ff
- https://nvd.nist.gov/vuln/detail/CVE-2021-32061
- https://github.com/sa7mon/S3Scanner/commit/fafa30a3bd35b496b3f7db9bfc35b75a8a06bcd1
- https://github.com/pypa/advisory-database/tree/main/vulns/s3scanner/PYSEC-2021-433.yaml