GitHub Advisoryadvisory · SwiftURL

GHSA-vcvg-xgr8-p5gq Arbitrary file read using percent-encoded relative paths in FileMiddleware

MEDIUM Published 2023-06-09 Modified 2023-06-09 Official page ↗
Aliases
CVE-2020-15230
Ecosystem
SwiftURL
Packages
github.com/vapor/vapor
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-06-09

Affected packages

• SwiftURL github.com/vapor/vapor: >= 4.0.0-rc.2.5, < 4.29.4 → fixed in 4.29.4

Description

Impact Attackers can access data at arbitrary filesystem paths on the same host as an application using `FileMiddleware`. Patches Version 4.29.4 Workarounds Upgrade to 4.24.4 or later, or disable `FileMiddleware`. References • Introduced in https://github.com/vapor/vapor/pull/2223 • Fixed by https://github.com/vapor/vapor/pull/2500 For more information If you have any questions or comments about this advisory: • Open an issue • Email us at [email protected]

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References