Arbitrary file read using percent-encoded relative paths in FileMiddleware
### Impact Attackers can access data at arbitrary filesystem paths on the same host as an application using `FileMiddleware`. ### Patches Version [4.29.4](https://github.com/vapor/vapor/releases/tag/4.29.4) ### Workarounds Upgrade to 4.24.4 or later, or disable `FileMiddleware`. ### References * Introduced in https://github.com/vapor/vapor/pull/2223 * Fixed by https://github.com/vapor/vapor/pull/2500 ### For more information If you have any questions or comments about this advisory: * Open [an issue](https://github.com/vapor/vapor/issues) * Email us at [security@vapor.codes](mailto:security@vapor.codes)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-15230US | medium6.5 | — | ||
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications us… | ||||
references
External citations — patches, advisories, analysis.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan