CVE-2020-35580

A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the…

published May 20, 2021

CVSS
—
EPSS
14%
Percentile
96.5
In the wild
Unconfirmed
What it is

A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBlox configuration file (e.g., searchblox/WEB-INF/config.xml), which contains both the Super Admin's API key and the base64 encoded SHA1 password hashes of other SearchBlox users.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.13975 · 96.5th percentile
Published
2021-05-20T15:25Z
EPSS history
Timeline
  • 20 MAY 15:25Z
    A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the…
    cvelistv5