Description

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.

Remediation

References

https://fusionauth.io/docs/v1/tech/release-notes

https://github.com/FusionAuth/fusionauth-issues/issues/1983

Related Vulnerabilities

CVE-2023-32007 Vulnerability in maven package org.apache.spark:spark-core_2.12

CVE-2021-43306 Vulnerability in maven package org.webjars.bowergithub.jquery-validation:jquery-validation

CVE-2023-1584 Vulnerability in maven package io.quarkus:quarkus-oidc

CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-elasticsearch-8

CVE-2019-14838 Vulnerability in maven package org.wildfly.core:wildfly-host-controller

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Release Notes Vendor Advisory Issue Tracking Third Party Advisory