Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2011-4212

The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a dev_appserver.RestrictedPathFunction._original_os reference within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.

Published

2011-10-30T19:55:01.007

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.2 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application google app_engine_python_sdk ≤ 1.5.3 Yes
Application google app_engine_python_sdk 1.0.1 Yes
Application google app_engine_python_sdk 1.0.2 Yes
Application google app_engine_python_sdk 1.1.0 Yes
Application google app_engine_python_sdk 1.1.1 Yes
Application google app_engine_python_sdk 1.1.2 Yes
Application google app_engine_python_sdk 1.1.3 Yes
Application google app_engine_python_sdk 1.1.4 Yes
Application google app_engine_python_sdk 1.1.5 Yes
Application google app_engine_python_sdk 1.1.6 Yes
Application google app_engine_python_sdk 1.1.7 Yes
Application google app_engine_python_sdk 1.1.8 Yes
Application google app_engine_python_sdk 1.1.9 Yes
Application google app_engine_python_sdk 1.2.0 Yes
Application google app_engine_python_sdk 1.2.1 Yes
Application google app_engine_python_sdk 1.2.2 Yes
Application google app_engine_python_sdk 1.2.3 Yes
Application google app_engine_python_sdk 1.2.4 Yes
Application google app_engine_python_sdk 1.2.5 Yes
Application google app_engine_python_sdk 1.2.6 Yes
Application google app_engine_python_sdk 1.2.7 Yes
Application google app_engine_python_sdk 1.3.0 Yes
Application google app_engine_python_sdk 1.3.1 Yes
Application google app_engine_python_sdk 1.3.2 Yes
Application google app_engine_python_sdk 1.3.3 Yes
Application google app_engine_python_sdk 1.3.4 Yes
Application google app_engine_python_sdk 1.3.5 Yes
Application google app_engine_python_sdk 1.3.6 Yes
Application google app_engine_python_sdk 1.3.7 Yes
Application google app_engine_python_sdk 1.3.8 Yes
Application google app_engine_python_sdk 1.4.0 Yes
Application google app_engine_python_sdk 1.4.1 Yes
Application google app_engine_python_sdk 1.4.2 Yes
Application google app_engine_python_sdk 1.4.3 Yes
Application google app_engine_python_sdk 1.5.0 Yes
Application google app_engine_python_sdk 1.5.1 Yes
Application google app_engine_python_sdk 1.5.2 Yes
References