CVE-2023-46851

Secure your products with top-tier expert knowledge and advanced Penetration Testing (CREST Approved)

Let's collaborate to build and maintain secure products

We transform threats into trust by integrating advanced tech and expertise in product security. Our approach encompasses Security by Design, rigorous security assurance and penetration testing, and compliance through expert documentation, from design to post-market.

We offer CREST-approved pen testing in EMEA, upholding top security standards.Cyber Legion - CREST Approved

Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them.  Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution.

This issue affects Apache Allura from 1.0.1 through 1.15.0.

Users are recommended to upgrade to version 1.16.0, which fixes the issue.  If you are unable to upgrade, set “disable_entry_points.allura.importers = forge-tracker, forge-discussion” in your .ini config file. (CVSS:4.9) (EPSS:0.05%) (Last Update:2023-11-15 14:13:58)    Latest security vulnerabilities (Gain Information) (CVSS score >= 4) – Deprecated! See channel description 

More To Explore