CVE-2008-6547: formencode - Access Restriction Bypass
Summary
CVE-2008-6547: schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors. Affects formencode versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Also tracked for
- python-formencode · Debian:11
The same CVE-2008-6547 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FormEncode is a Python package (python-formencode) that provides form validation and conversion. It is commonly used in web applications to validate user input and ensure data integrity. However, version 1.0 of FormEncode does not properly apply the chained_validators feature, which can allow attackers to bypass intended access restrictions through unknown vectors.
Vulnerability Detail
The vulnerability in FormEncode version 1.0 allows attackers to bypass access restrictions that were intended to be enforced. By exploiting this vulnerability, an attacker can potentially gain unauthorized access to sensitive information or perform actions that should be restricted. The exact vectors through which this bypass can be achieved are unknown.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
pip install --upgrade "formencode==1.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The vulnerability in FormEncode version 1.0 allows for access restriction bypass, potentially leading to unauthorized access or actions. It is recommended to upgrade to version 1.0.1 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for formencode →
FAQ
FormEncode is a Python package used for form validation and conversion in web applications.
The vulnerability allows attackers to bypass access restrictions, potentially leading to unauthorized access or unauthorized actions.
Version 1.0 of FormEncode is affected by this vulnerability.
Yes, the vulnerability has been fixed in version 1.0.1 and later of FormEncode.
No specific workarounds have been provided for this vulnerability.
