Description

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.

Remediation

References

https://fusionauth.io/docs/v1/tech/release-notes

https://github.com/FusionAuth/fusionauth-issues/issues/1983

Related Vulnerabilities

CVE-2022-23974 Vulnerability in maven package org.apache.pinot:pinot

CVE-2022-4521 Vulnerability in maven package org.wso2.carbon.registry:org.wso2.carbon.registry.profiles.ui

CVE-2021-43841 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2019-13127 Vulnerability in maven package org.webjars.npm:mxgraph

CVE-2019-10433 Vulnerability in maven package com.ztbsuper:dingding-notifications

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Release Notes Vendor Advisory Issue Tracking Third Party Advisory