QwikSec

Security Database

CVE

CWE

Training

CVE-2018-1299

Published: Feb 6, 2018

Modified: Sep 16, 2024

PUBLISHED

Description

In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura, such as Nginx, Apache/mod_wsgi or paster may prevent the attack from succeeding. Others, such as gunicorn do not prevent it and leave Allura vulnerable.

Vendor	Product	Versions
Apache Software Foundation	Apache Allura	affected `1.0.0 to 1.7.0`

References

https://allura.apache.org/posts/2018-allura-1.8.0.html

x_refsource_CONFIRM

[dev] 20180206 [SECURITY] CVE-2018-1299 Apache Allura directory traversal vulnerability

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.