CVE-2011-4211

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWED_MODES and ALLOWED_DIRS changes within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Oct 30, 2011
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2011

CVE-2011-42127.2The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users CVE-2011-42137.2The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local CVE-2011-421410.0OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to bypass authentication and obtain administrator privCVE-2011-42157.5SQL injection vulnerability in lib/ooz_access.php in OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers tCVE-2011-42169.3Investintech.com SlimPDF Reader does not properly restrict write operations, which allows remote attackers to cause a denial of service (appCVE-2011-42179.3Investintech.com SlimPDF Reader does not properly restrict read operations during block data moves, which allows remote attackers to cause aCVE-2011-42189.3Investintech.com SlimPDF Reader does not prevent faulting-instruction data from affecting write operations, which allows remote attackers toCVE-2011-42199.3Investintech.com SlimPDF Reader does not prevent faulting-address data from affecting branch selection, which allows remote attackers to cauCVE-2011-42209.3Investintech.com SlimPDF Reader does not properly restrict the arguments to unspecified function calls, which allows remote attackers to cauCVE-2011-42219.3Unspecified vulnerability in Investintech.com Able2Doc and Able2Doc Professional allows remote attackers to cause a denial of service (appliCVE-2011-42229.3Unspecified vulnerability in Investintech.com Able2Extract and Able2Extract Server allows remote attackers to cause a denial of service (appCVE-2011-42239.3Unspecified vulnerability in Investintech.com Absolute PDF Server allows remote attackers to cause a denial of service (application crash) o
CVE-2011-4211: High severity, CVSS 7.2 | Vulnix