Vulnerability · Published Oct 7, 2021 · Assigned by mitre
CVE-2021-40978
High 7.5
In plain English
A high-severity security flaw in the python-mkdocs package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 15.1% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)15.1%top 3.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Nuclei, Public PoC
Official description
The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information. NOTE: the vendor has disputed this as described in https://github.com/mkdocs/mkdocs/issues/2601.] and https://github.com/nisdn/CVE-2021-40978/issues/1
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-mkdocs | no fix listed | DEBIAN-CVE-2021-40978 |
| Debian:13 | python-mkdocs | no fix listed | DEBIAN-CVE-2021-40978 |
| Debian:14 | python-mkdocs | no fix listed | DEBIAN-CVE-2021-40978 |
| PyPI | mkdocs | 1.2.3 | GHSA-qh9q-34h6-hcv9 |
| PyPI | mkdocs | 1.2.3 | PYSEC-2021-878 |
Affected products (as reported)
References
- https://github.com/mkdocs/mkdocs x_refsource_MISC
- https://github.com/nisdn/CVE-2021-40978 x_refsource_MISC
- https://github.com/mkdocs/mkdocs/issues/2601 x_refsource_MISC
- https://github.com/nisdn/CVE-2021-40978/issues/1 x_refsource_MISC