Vulnerability · Published Nov 7, 2023 · Assigned by apache

CVE-2023-46851Apache Allura: sensitive information exposure via import

Medium 4.9

In plain English

A medium-severity improper input validation in Apache Allura from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 77% of all known vulnerabilities).

Severity (CVSS NVD)4.9Medium

Exploit odds (30 days)1.6%top 23.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution. This issue affects Apache Allura from 1.0.1 through 1.15.0. Users are recommended to upgrade to version 1.16.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Allura	1.0.1 – through 1.15.0

Weakness: CWE-20, CWE-73, CWE-200

References

https://allura.apache.org/posts/2023-allura-1.16.0.html vendor-advisory
https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx vendor-advisory