CVE-2022-45921

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request

High · published November 28, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00711 · 53.0th percentile
Published
2022-11-28T00:00Z
EPSS history
Timeline
  • 28 NOV 00:00Z
    FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request
    cvelistv5