GHSA-vcvg-xgr8-p5gqMediumCVSS 6.5

Arbitrary file read using percent-encoded relative paths in FileMiddleware

Published
June 9, 2023
Last Modified
June 19, 2023

🔗 CVE IDs covered (1)

CVE-2020-15230 →

📋 Description

Impact

Attackers can access data at arbitrary filesystem paths on the same host as an application using FileMiddleware.

Patches

Version 4.29.4

Workarounds

Upgrade to 4.24.4 or later, or disable FileMiddleware.

References

  • Introduced in https://github.com/vapor/vapor/pull/2223
  • Fixed by https://github.com/vapor/vapor/pull/2500

For more information

If you have any questions or comments about this advisory:

🎯 Affected products1

  • swift/github.com/vapor/vapor:>= 4.0.0-rc.2.5, < 4.29.4

🔗 References (5)