Arbitrary file read using percent-encoded relative paths in FileMiddleware
### Impact Attackers can access data at arbitrary filesystem paths on the same host as an application using `FileMiddleware`. ### Patches Version [4.29.4](https://github.com/vapor/vapor/releases/tag/4.29.4) ### Workarounds Upgrade to 4.24.4 or later, or disable `FileMiddleware`. ### References * Introduced in https://github.com/vapor/vapor/pull/2223 * Fixed by https://github.com/vapor/vapor/pull/2500 ### For more information If you have any questions or comments about this advisory: * Open [an issue](https://github.com/vapor/vapor/issues) * Email us at [security@vapor.codes](mailto:security@vapor.codes)
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-15230US | medium6.5 | — | ||
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications us… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan