{"id":"CVE-2023-46851","state":"PUBLISHED","title":"Apache Allura: sensitive information exposure via import","description":"Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them.  Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution.\n\nThis issue affects Apache Allura from 1.0.1 through 1.15.0.\n\nUsers are recommended to upgrade to version 1.16.0, which fixes the issue.  If you are unable to upgrade, set \"disable_entry_points.allura.importers = forge-tracker, forge-discussion\" in your .ini config file.\n\n","publishedAt":"2023-11-07T08:56:35.172Z","updatedAt":"2024-09-04T20:12:28.257Z","severity":null,"assigner":"apache","products":["Apache Software Foundation Apache Allura"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Allura","defaultStatus":"unaffected","versions":[{"version":"1.0.1","status":"affected","lessThanOrEqual":"1.15.0","versionType":"semver"}]}],"references":["https://allura.apache.org/posts/2023-allura-1.16.0.html","https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx"],"weaknesses":["CWE-20","CWE-73","CWE-200"],"ingestedAt":"2026-10-29T20:06:24.729Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/46xxx/CVE-2023-46851.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-46851","state":"PUBLISHED","datePublished":"2023-11-07T08:56:35.172Z","dateUpdated":"2024-09-04T20:12:28.257Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2023-10-27T16:19:54.325Z"},"containers":{"cna":{"title":"Apache Allura: sensitive information exposure via import","descriptions":[{"lang":"en","value":"Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them.  Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution.\n\nThis issue affects Apache Allura from 1.0.1 through 1.15.0.\n\nUsers are recommended to upgrade to version 1.16.0, which fixes the issue.  If you are unable to upgrade, set \"disable_entry_points.allura.importers = forge-tracker, forge-discussion\" in your .ini config file.\n\n"}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Allura","defaultStatus":"unaffected","versions":[{"version":"1.0.1","status":"affected","lessThanOrEqual":"1.15.0","versionType":"semver"}]}],"references":[{"url":"https://allura.apache.org/posts/2023-allura-1.16.0.html","tags":["vendor-advisory"]},{"url":"https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"critical"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-73","description":"CWE-73 External Control of File Name or Path","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2023-11-07T08:56:35.172Z"},"credits":[{"lang":"en","type":"finder","value":"Stefan Schiller (Sonar)"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://allura.apache.org/posts/2023-allura-1.16.0.html","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T20:53:21.859Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-04T20:12:19.673700Z","id":"CVE-2023-46851","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-04T20:12:28.257Z"}}]}}}