CVE-2018-1299: Path Traversal
In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura, such as Nginx, Apache/modwsgi or paster may prevent the attack from succeeding. Others, such as gunicorn do not prevent it and leave Allura vulnerable.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-1299?
CVE-2018-1299 is a vulnerability in Apache Allura web application that allows unauthenticated attackers to retrieve arbitrary files.
What is the severity of CVE-2018-1299?
CVE-2018-1299 has a severity rating of 7.5 (High).
How does CVE-2018-1299 affect Apache Allura?
CVE-2018-1299 affects Apache Allura versions up to and including 1.8.0.
How can I fix CVE-2018-1299 in Apache Allura?
To fix CVE-2018-1299 in Apache Allura, update to version 1.8.0 or later, or use a web server such as Nginx, Apache/mod_wsgi, or paster that prevents the attack.
Where can I find more information about CVE-2018-1299?
More information about CVE-2018-1299 can be found on the Apache Allura website and the Apache mailing list.