CVEvulnerability

CVE-2020-15230

6.5 MEDIUM Published 2020-10-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-10-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-22

Description

Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.

Affected configurations

• vapor project vapor (< 4.29.4)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References