Description
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
Remediation
References
https://fusionauth.io/docs/v1/tech/release-notes
https://github.com/FusionAuth/fusionauth-issues/issues/1983
Related Vulnerabilities
CVE-2022-2217 Vulnerability in npm package parse-url
CVE-2022-36914 Vulnerability in maven package org.jenkins-ci.plugins:files-found-trigger
CVE-2019-9843 Vulnerability in maven package com.diffplug.spotless:spotless-plugin-gradle
CVE-2022-22984 Vulnerability in npm package snyk
CVE-2023-43123 Vulnerability in maven package org.apache.storm:storm-server