CVE-2013-7300
Publication date 2 February 2014
Last updated 24 July 2024
Ubuntu priority
Description
Absolute path traversal vulnerability in cantata before 1.2.2 allows local users to read arbitrary files via a full pathname in a request to the internal httpd server. NOTE: this vulnerability can be leveraged by remote attackers using CVE-2013-7301.
From the Ubuntu Security Team
Automatically started HTTP server listens on all interfaces and will serve any file that the user running the HTTP server has access to, including e.g. ssh private keys.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| cantata | 14.04 LTS trusty | Not in release |