Description
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
Remediation
References
https://fusionauth.io/docs/v1/tech/release-notes
https://github.com/FusionAuth/fusionauth-issues/issues/1983
Related Vulnerabilities
CVE-2022-25647 Vulnerability in maven package com.google.code.gson:gson
CVE-2022-34191 Vulnerability in maven package io.jenkins.plugins:cavisson-ns-nd-integration
CVE-2022-29567 Vulnerability in maven package com.vaadin:vaadin
CVE-2019-10247 Vulnerability in maven package org.eclipse.jetty:jetty-server
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-trino