CVE-2019-15630: Path Traversal
First published: Fri Aug 30 2019(Updated: )
Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process.
Credit: security@salesforce.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.mule.runtime:mule | >=3.0.0<=4.1.5 | |
| MuleSoft API Gateway | ||
| Wibu CodeMeter Runtime | >=3.2.0<=3.9.3 | |
| Wibu CodeMeter Runtime | >=4.1.0<=4.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-15630
- https://help.mulesoft.com/s/article/Directory-traversal-vulnerability-affecting-runtimes-of-MuleSoft-customers-running-certain-use-cases-of-Mule-flows-and-API-Gateways
- https://github.com/advisories/GHSA-mwh9-gr45-xvv4 (Advisory)
- https://help.salesforce.com/apex/HTViewSolution?urlname=CVE-2019-15630-Directory-Traversal-in-MuleSoft-Runtime&language=en_US
Frequently Asked Questions
What is the severity of CVE-2019-15630?
CVE-2019-15630 has a critical severity rating due to its potential to exploit directory traversal vulnerabilities in multiple MuleSoft components.
How do I fix CVE-2019-15630?
To fix CVE-2019-15630, upgrade to MuleSoft Mule Runtime version 4.1.6 or later, or 3.9.4 or later, depending on your current version.
Which versions of MuleSoft are affected by CVE-2019-15630?
CVE-2019-15630 affects MuleSoft Mule Runtime 3.2.0 and higher, any version of API Gateway, and MuleSoft Mule Runtime 4.1.0 and higher released before August 1, 2019.
What types of vulnerabilities does CVE-2019-15630 involve?
CVE-2019-15630 involves directory traversal vulnerabilities that can potentially allow unauthorized access to files on the server.
Can CVE-2019-15630 be exploited remotely?
Yes, CVE-2019-15630 can be exploited remotely, enabling attackers to access sensitive information on affected systems.
- collector/github-advisory-latest
- alias/GHSA-mwh9-gr45-xvv4
- alias/CVE-2019-15630
- collector/github-advisory
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- package-manager/maven
- vendor/mulesoft
- canonical/mulesoft api gateway
- canonical/wibu codemeter runtime
- version/wibu codemeter runtime/3.2.0
- version/wibu codemeter runtime/3.9.3
- version/wibu codemeter runtime/4.1.0
- version/wibu codemeter runtime/4.2.1