{"id":"CVE-2008-6547","aliases":["DEBIAN-CVE-2008-6547","EUVD-2009-0005","GHSA-9jp4-68vc-r8wq","PYSEC-2009-5"],"status":"published","title":"FormEncode Access Restrictions Bypass","description":"schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01488,"percentile":0.7422,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2009-03-30T01:00:00Z","modified":"2026-10-23T17:47:24Z","fixes":[{"ecosystem":"PyPI","package":"formencode","fixed_in":["1.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-formencode","fixed_in":["1.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-formencode","fixed_in":["1.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-formencode","fixed_in":["1.0.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"formencode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"last_affected":"1.0"},{"fixed":"1.0.1"}]}],"versions":["1.0"]},{"source":"osv","ecosystem":"Debian:12","package":"python-formencode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-formencode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-formencode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"formencode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.0.1"}]}],"versions":["1.0"]},{"source":"osv","ecosystem":"PyPI","package":"formencode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1"}]}],"versions":["0.2","0.2.1","0.2.2","0.3","0.4","0.5","0.5.1","0.6","0.7","0.7.1","0.9","1.0"]}],"products":[{"vendor":"formencode","product":"formencode"}],"references":[{"url":"http://www.securityfocus.com/bid/30282","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00607.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://sourceforge.net/tracker/index.php?func=detail\u0026aid=1925164\u0026group_id=91231\u0026atid=596416","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/43878","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://osvdb.org/47082","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://secunia.com/advisories/31163","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://sourceforge.net/tracker/download.php?group_id=91231\u0026atid=596416\u0026file_id=271779\u0026aid=1925164","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web"]},{"url":"http://secunia.com/advisories/31081","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-6547","tags":["advisory"]},{"url":"https://web.archive.org/web/20080905200034/http://secunia.com/advisories/31081","tags":["web"]},{"url":"https://web.archive.org/web/20081013102442/http://secunia.com/advisories/31163","tags":["web"]},{"url":"https://web.archive.org/web/20200228145643/http://www.securityfocus.com/bid/30282","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/formencode/PYSEC-2009-5.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9jp4-68vc-r8wq","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2008-6547","tags":["advisory"]},{"url":"https://github.com/davidfraser/formencode","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2008-6547","description":"schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.","status":"published","published":"2009-03-30T01:00:00Z","modified":"2024-08-07T11:34:47.144Z","updated_at":"2026-11-02T14:34:46.587139Z"}],"euvd":[{"id":"EUVD-2009-0005","description":"schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.","status":"published","published":"2009-03-30T01:00:00Z","modified":"2024-08-07T11:34:47Z","updated_at":"2026-11-03T01:38:35.357732Z"}],"ghsa":[{"id":"GHSA-9jp4-68vc-r8wq","title":"FormEncode Access Restrictions Bypass","description":"`schema.py` in FormEncode for Python (python-formencode) 1.0 does not apply the `chained_validators` feature, which allows attackers to bypass intended access restrictions via unknown vectors.","status":"published","published":"2022-05-17T02:11:13Z","modified":"2024-09-20T17:54:13Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2008-6547","description":"schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.","status":"published","published":"2009-03-30T01:30:00.483Z","modified":"2026-06-16T23:02:25.78Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:01:31.451035Z"}],"osv":[{"id":"GHSA-9jp4-68vc-r8wq","title":"FormEncode Access Restrictions Bypass","description":"`schema.py` in FormEncode for Python (python-formencode) 1.0 does not apply the `chained_validators` feature, which allows attackers to bypass intended access restrictions via unknown vectors.","status":"published","published":"2022-05-17T02:11:13Z","modified":"2024-09-20T17:54:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"CVE-2008-6547","description":"schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.","status":"published","published":"2009-03-30T01:30:00Z","modified":"2026-04-10T03:40:28.709655Z","updated_at":"2026-11-02T15:43:57.452479Z"},{"id":"DEBIAN-CVE-2008-6547","description":"schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.","status":"published","published":"2009-03-30T01:30:00.483Z","modified":"2026-10-23T17:47:24.341532727Z","updated_at":"2026-11-02T15:45:23.742363Z"},{"id":"PYSEC-2009-5","description":"schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.","status":"published","published":"2009-03-30T01:30:00Z","modified":"2026-06-10T17:01:17.605181809Z","updated_at":"2026-11-02T15:52:51.254177Z"}]}}