CVE-2023-46851

Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution. This issue affects Apache Allura from 1.0.1 through 1.15.0. Users are recommended to upgrade to version 1.16.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://allura.apache.org/posts/2023-allura-1.16.0.html	Patch Vendor Advisory
https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx	Mailing List Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*

History

15 Nov 2023, 14:13

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.9
CPE		cpe:2.3:a:apache:allura::::::::
First Time		Apache Apache allura
References	~~() https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx -~~	() https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx - Mailing List, Vendor Advisory
References	~~() https://allura.apache.org/posts/2023-allura-1.16.0.html -~~	() https://allura.apache.org/posts/2023-allura-1.16.0.html - Patch, Vendor Advisory

07 Nov 2023, 12:14

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-07 09:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-46851

Mitre link : CVE-2023-46851

CVE.ORG link : CVE-2023-46851

JSON object : View

Products Affected

apache

allura

CWE

CWE-20

Improper Input Validation

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-73

External Control of File Name or Path

{"id": "CVE-2023-46851", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2023-11-07T09:15:07.313", "references": [{"url": "https://allura.apache.org/posts/2023-allura-1.16.0.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them.\u00a0 Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution.\n\nThis issue affects Apache Allura from 1.0.1 through 1.15.0.\n\nUsers are recommended to upgrade to version 1.16.0, which fixes the issue.\u00a0 If you are unable to upgrade, set \"disable_entry_points.allura.importers = forge-tracker, forge-discussion\" in your .ini config file.\n\n"}, {"lang": "es", "value": "La importaci\u00f3n de Allura Discussion y Allura Forum no restringe los valores de URL especificados en los archivos adjuntos. Los administradores de proyectos pueden ejecutar estas importaciones, lo que podr\u00eda hacer que Allura lea archivos locales y los exponga. La exposici\u00f3n de archivos internos puede dar lugar a otros exploits, como el secuestro de sesi\u00f3n o la ejecuci\u00f3n remota de c\u00f3digo. Este problema afecta a Apache Allura desde la versi\u00f3n 1.0.1 hasta la 1.15.0. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.16.0, que soluciona el problema. Si no puede actualizar, configure \"disable_entry_points.allura.importers = forge-tracker, forge-discussion\" en su archivo de configuraci\u00f3n .ini."}], "lastModified": "2023-11-15T14:13:57.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F215DB81-2592-4B04-9E76-5F69560CAD07", "versionEndExcluding": "1.16.0", "versionStartIncluding": "1.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}