NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.
References
Configurations
History
07 Nov 2023, 03:05
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2019-08-22 16:15
Updated : 2024-02-28 17:08
NVD link : CVE-2019-14751
Mitre link : CVE-2019-14751
CVE.ORG link : CVE-2019-14751
JSON object : View
Products Affected
nltk
- nltk
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')