CVE-2015-8309

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to read arbitrary files via the "value" parameter to "download."

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.fomori.org/cherrymusic/Changes.htmlRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/97149
https://github.com/devsnd/cherrymusic/commit/62dec34a1ea0741400dd6b6c660d303dcd651e86Patch, Third Party Advisory
https://github.com/devsnd/cherrymusic/issues/598Third Party Advisory
https://www.exploit-db.com/exploits/40361/Exploit, Third Party Advisory, VDB Entry
http://www.fomori.org/cherrymusic/Changes.htmlRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/97149
https://github.com/devsnd/cherrymusic/commit/62dec34a1ea0741400dd6b6c660d303dcd651e86Patch, Third Party Advisory
https://github.com/devsnd/cherrymusic/issues/598Third Party Advisory
https://www.exploit-db.com/exploits/40361/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Mar 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-83105.4Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or H CVE-2015-83127.8Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system CVE-2015-83135.9GnuTLS incorrectly validates the first byte of padding in CBC modes CVE-2015-83147.5The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persis CVE-2015-83157.5The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "re CVE-2015-83165.9Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attacke CVE-2015-83175.0The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (CVE-2015-83187.8Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL CVE-2015-83197.8Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL CVE-2015-83205.0Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct CVE-2015-83228.8NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.CVE-2015-83244.6The ext4 implementation in the Linux kernel before 2.6.34 does not properly track the initialization of certain data structures, which allow