GHSA-mwh9-gr45-xvv4

ghsaUSosv

Mule modules contain Directory Traversal

view advisory published 2022-05-24Licence: CC-BY-4.0

Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway (all versions) released before August 1, 2019 allow remote attackers to read files accessible to the Mule process.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-15630US	high7.5	3.00% (87th)	—	2019-08-30
Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 a…

references

External citations — patches, advisories, analysis.

https://github.com/mulesoft/mulePACKAGE
https://help.mulesoft.com/s/article/Directory-traversal-vulnerability-affecting-runtimes-of-MuleSoft-customers-running-certain-use-cases-of-Mule-flows-and-API-GatewaysWEB
https://nvd.nist.gov/vuln/detail/CVE-2019-15630ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan