Description
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
Remediation
References
https://fusionauth.io/docs/v1/tech/release-notes
https://github.com/FusionAuth/fusionauth-issues/issues/1983
Related Vulnerabilities
CVE-2020-9497 Vulnerability in maven package org.apache.guacamole:guacamole
CVE-2018-20676 Vulnerability in maven package org.webjars.bowergithub.jasny:bootstrap
CVE-2017-9804 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2023-25158 Vulnerability in maven package org.geotools.jdbc:gt-jdbc-oracle
CVE-2022-3971 Vulnerability in npm package matrix-appservice-irc