CVE-2023-46851

Apache Allura: sensitive information exposure via import

State: Published
Severity: Not scored
Published: Nov 7, 2023
Updated: Sep 4, 2024
Reserved: Oct 27, 2023

Description

Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them. Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution.

This issue affects Apache Allura from 1.0.1 through 1.15.0.

Users are recommended to upgrade to version 1.16.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.

Scores

The record has no CVSS score.

Weaknesses

CWE-20 Improper Input Validation
CWE-73 External Control of File Name or Path
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Apache AlluraApache Software Foundation	1.0.1 through 1.15.0Affected

References

https://allura.apache.org/posts/2023-allura-1.16.0.htmlvendor-advisory
https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gxvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.