Deluge CVE-2017-9031 Directory Traversal Vulnerability

Bugtraq ID:	99099
Class:	Input Validation Error
CVE:	CVE-2017-9031
Remote:	Yes
Local:	No
Published:	Jun 16 2017 12:00AM
Updated:	Jun 16 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	openSUSE Leap 42.2 deluge-torrent deluge 1.3.14 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	deluge-torrent deluge 1.3.15

Deluge CVE-2017-9031 Directory Traversal Vulnerability

Deluge is prone to a directory-traversal vulnerability.

Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to retrieve sensitive information. This may aid in further attacks.

Versions prior to Deluge 1.3.15 are vulnerable.

Deluge CVE-2017-9031 Directory Traversal Vulnerability

An attacker can exploit this issue using a web browser.

Deluge CVE-2017-9031 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Deluge CVE-2017-9031 Directory Traversal Vulnerability

References:

• [WebUI] Check render template files exist and raise 404 if not (deluge)
  
• Deluge 1.3.15 (Deluge)
  
• Deluge Homepage (deluge)
  
• deluge: CVE-2017-9031: directory traversal attack vulnerability (Debian)