CVE-2019-15630: Path Traversal
Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process.
Other sources
Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway (all versions) released before August 1, 2019 allow remote attackers to read files accessible to the Mule process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-15630?
CVE-2019-15630 has a critical severity rating due to its potential to exploit directory traversal vulnerabilities in multiple MuleSoft components.
How do I fix CVE-2019-15630?
To fix CVE-2019-15630, upgrade to MuleSoft Mule Runtime version 4.1.6 or later, or 3.9.4 or later, depending on your current version.
Which versions of MuleSoft are affected by CVE-2019-15630?
CVE-2019-15630 affects MuleSoft Mule Runtime 3.2.0 and higher, any version of API Gateway, and MuleSoft Mule Runtime 4.1.0 and higher released before August 1, 2019.
What types of vulnerabilities does CVE-2019-15630 involve?
CVE-2019-15630 involves directory traversal vulnerabilities that can potentially allow unauthorized access to files on the server.
Can CVE-2019-15630 be exploited remotely?
Yes, CVE-2019-15630 can be exploited remotely, enabling attackers to access sensitive information on affected systems.