CVE-2011-4211
Summary
| CVE | CVE-2011-4211 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-10-30 19:55:00 UTC |
| Updated | 2017-08-29 01:30:00 UTC |
| Description | The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWED_MODES and ALLOWED_DIRS changes within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364. |
Risk And Classification
Problem Types: CWE-264
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | App Engine Python Sdk | 1.0.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.0.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.8 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.9 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.8 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.0.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.0.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.8 | All | All | All | |
| Application | App Engine Python Sdk | 1.1.9 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.2.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.4 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.5 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.6 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.7 | All | All | All | |
| Application | App Engine Python Sdk | 1.3.8 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.2 | All | All | All | |
| Application | App Engine Python Sdk | 1.4.3 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.0 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.1 | All | All | All | |
| Application | App Engine Python Sdk | 1.5.2 | All | All | All | |
| Application | App Engine Python Sdk | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Google App Engine Python SDK 'FakeFile' Object Local Security Bypass Vulnerability | BID | www.securityfocus.com | |
| SdkReleaseNotes - googleappengine - Google App Engine Python SDK Release Notes - Google App Engine - Google Project Hosting | MISC | code.google.com | Patch |
| Access denied | blog.watchfire.com used Cloudflare to restrict access | MISC | blog.watchfire.com | Exploit |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.