CVE-2023-46851: Apache Allura: sensitive information exposure via import
First published: Tue Nov 07 2023(Updated: )
Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution. This issue affects Apache Allura from 1.0.1 through 1.15.0. Users are recommended to upgrade to version 1.16.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| >=1.0.1<1.16.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Apache Allura vulnerability?
The vulnerability ID for this Apache Allura vulnerability is CVE-2023-46851.
What is the title of this Apache Allura vulnerability?
The title of this Apache Allura vulnerability is Apache Allura: sensitive information exposure via import.
What is the description of this Apache Allura vulnerability?
This Apache Allura vulnerability allows Allura Discussion and Allura Forum importing without restricting URL values specified in attachments, which could cause Allura to read local files and expose them.
What software is affected by this Apache Allura vulnerability?
The Apache Allura software versions between 1.0.1 and 1.16.0 are affected by this vulnerability.
What is the severity level of this Apache Allura vulnerability?
The severity level of this Apache Allura vulnerability is medium with a CVSS score of 4.9.
What is the Common Weakness Enumeration (CWE) ID for this Apache Allura vulnerability?
The Common Weakness Enumeration (CWE) IDs for this Apache Allura vulnerability are CWE-20, CWE-73, and CWE-200.
How can this Apache Allura vulnerability be exploited?
This Apache Allura vulnerability can be exploited by running imports with specified URLs in attachments, which can lead to the exposure of internal files and potentially result in other exploits like session hijacking or remote attacks.
Where can I find more information about this Apache Allura vulnerability?
You can find more information about this Apache Allura vulnerability at the following references: [Apache Allura 1.16.0 Announcement](https://allura.apache.org/posts/2023-allura-1.16.0.html) and [Apache Allura Mailing List Thread](https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx).
- agent/type
- agent/references
- agent/first-publish-date
- agent/remedy
- agent/author
- agent/weakness
- agent/severity
- agent/title
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/apache
- canonical/apache allura
- version/apache allura/1.0.1