Lucene search

GitHub_MCVELIST:CVE-2020-15230

HistoryOct 02, 2020 - 6:55 p.m.

CVE-2020-15230 Arbitrary file read un Vapor

2020-10-0218:55:14

CWE-22

GitHub_M

www.cve.org

vapor

web framework

file read

CVSS3

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

44.4%

JSON

Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.

CNA Affected

[
  {
    "product": "vapor",
    "vendor": "vapor",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.29.4"
      }
    ]
  }
]

References

github.com/vapor/vapor/commit/cf1651f7ff76515593f4d8ca6e6e15d2247fe255

github.com/vapor/vapor/pull/2500

github.com/vapor/vapor/security/advisories/GHSA-vcvg-xgr8-p5gq

CVSS3

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

AI Score

8.5

Confidence

High

EPSS

0.001

Percentile

44.4%

JSON

Related for CVELIST:CVE-2020-15230