Vulnerability · Published Oct 2, 2020 · Assigned by GitHub_M
CVE-2020-15230Arbitrary file read un Vapor
High 8.5
In plain English
A high-severity path traversal in vapor from vapor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.1)8.5High
Exploit odds (30 days)1.5%top 25.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
References
- https://github.com/vapor/vapor/security/advisories/GHSA-vcvg-xgr8-p5gq x_refsource_CONFIRM
- https://github.com/vapor/vapor/pull/2500 x_refsource_MISC
- https://github.com/vapor/vapor/commit/cf1651f7ff76515593f4d8ca6e6e15d2247fe255 x_refsource_MISC