CVE-2021-31153

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2021/05/18/1Exploit, Mailing List, Third Party Advisory
https://gitlab.com/edneville/please/-/tree/master/src/binThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/18/1Exploit, Mailing List, Third Party Advisory
https://gitlab.com/edneville/please/-/tree/master/src/binThird Party Advisory

Timeline

Published: May 27, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-311547.8pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain CVE-2021-311557.8Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at l CVE-2021-311567.5Allied Telesis AT-S115 1.2.0 devices before 1.00.024 with Boot Loader 1.00.006 allow Directory Traversal to achieve partial access to data.CVE-2021-311586.5In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user'CVE-2021-311595.3Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the CVE-2021-31167.5before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data be CVE-2021-311607.5Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.CVE-2021-311629.8In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.CVE-2021-311647.5Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.CVE-2021-311657.8Windows Container Manager Service Elevation of Privilege Vulnerability CVE-2021-311669.8HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2021-311677.8Windows Container Manager Service Elevation of Privilege Vulnerability