CVEvulnerability

CVE-2023-46851

4.9 MEDIUM Published 2023-11-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-11-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20, CWE-200, CWE-73

Description

Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them.  Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution. This issue affects Apache Allura from 1.0.1 through 1.15.0. Users are recommended to upgrade to version 1.16.0, which fixes the issue.  If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.

Affected configurations

• apache allura (>= 1.0.1 < 1.16.0)

Related

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-73 External Control of File Name or Path weakness

References