CVE-2012-0878
Paste Script has improper group memberships permissions
CVE-2012-0878 is a medium vulnerability (CVSS 5.1) in Pythonpaste Paste, published May 1, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.03%, the 90th percentile. Fixed in pastescript 2.0.1.
- Severity
- 5.1 MediumCVSS 2.0, NVD
- Exploit chance
- 4.03%EPSS, 90th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.1pastescript +8 more
Description
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pastescriptPyPI | before 2.0.1 | 2.0.1 |
pastePyPI | before 1.7.5.1 | 1.7.5.1 |
pastescriptDebian:12 | before 1.7.5-2 | 1.7.5-2 |
pastescriptDebian:13 | before 1.7.5-2 | 1.7.5-2 |
pastescriptDebian:14 | before 1.7.5-2 | 1.7.5-2 |
pastescriptPyPI | before 2.0.1, plus listed versions 0.30.3.10.40.4.10.4.2 Show 28 moreShow less0.50.5.10.90.9.60.9.70.9.81.01.11.31.3.11.3.21.3.31.3.41.3.51.3.61.61.6.11.6.1.11.6.21.6.31.71.7.21.7.31.7.41.7.4.11.7.4.21.7.52.0 | 2.0.1 |
pastePyPI | before 1.7.5.1, plus listed versions 0.30.40.4.10.50.9 Show 28 moreShow less0.9.10.9.20.9.30.9.50.9.60.9.70.9.80.9.8.11.01.0.11.11.1.11.21.2.11.31.41.4.11.4.21.51.5.11.61.71.7.11.7.21.7.31.7.3.11.7.41.7.5 | 1.7.5.1 |
python-paste-scriptRed Hat:enterprise_linux:6::server | before 0:1.7.3-5.el6_3 | 0:1.7.3-5.el6_3 |
python-paste-scriptRed Hat:enterprise_linux:6::workstation | before 0:1.7.3-5.el6_3 | 0:1.7.3-5.el6_3 |
What each source reports
NVD Score used
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
CVE-2012-0878- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
CVE-2012-0878- Updated
- 2026-11-02
EUVDEUVD-2012-0025No score
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
EUVD-2012-0025- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-27px-qpmj-qg38
Paste Script has improper group memberships permissions
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
GHSA-27px-qpmj-qg38- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-27px-qpmj-qg38
Paste Script has improper group memberships permissions
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
GHSA-27px-qpmj-qg38- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVPYSEC-2026-2859
Paste Script has improper group memberships permissions
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
PYSEC-2026-2859- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVNo score
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
CVE-2012-0878- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-0878No score
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
DEBIAN-CVE-2012-0878- Updated
- 2026-11-02
OSVPYSEC-2012-15No score
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
- Record
PYSEC-2012-15- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugzilla.redhat.com/show_bug.cgi?id=796790
openwall.com/lists/oss-security/2012/02/23/1
bitbucket.org/ianb/pastescript/pull-request/3/fix-group-permissions-for-pastescriptserve
secunia.com/advisories/48812
rhn.redhat.com/errata/RHSA-2012-1206.html
Show 17 moreShow less
groups.google.com/group/paste-users/browse_thread/thread/2aa651ba331c2471
nvd.nist.gov/vuln/detail/CVE-2012-0878
github.com/cdent/pastescript/commit/b5f36f2995e1ae117cc53d2bd458d7fb33e4cabe
web.archive.org/web/20140723093519/http://secunia.com/advisories/50410
security-tracker.debian.org/tracker/CVE-2012-0878
pypi.org/project/pastescript
access.redhat.com/errata/RHSA-2012:1206
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1206.json
cve.org/CVERecord?id=CVE-2012-0878