GitHub Advisoryadvisory · Maven

GHSA-mwh9-gr45-xvv4 Mule modules contain Directory Traversal

HIGH Published 2022-05-24 Modified 2023-09-25 Official page ↗
Aliases
CVE-2019-15630
Ecosystem
Maven
Packages
org.mule.runtime:mule
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-07-17

Affected packages

• Maven org.mule.runtime:mule: >= 3.0.0, <= 4.1.5 (no fix yet)

Description

Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway (all versions) released before August 1, 2019 allow remote attackers to read files accessible to the Mule process.

Related

Alias · CVE (1)

  • CVE-2019-15630 Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References