|Date: (C)2018-02-07 (M)2018-02-15|| |
In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura, such as Nginx, Apache/mod_wsgi or paster may prevent the attack from succeeding. Others, such as gunicorn do not prevent it and leave Allura vulnerable.
|CVSS Score: 4.3||Access Vector: |
|Exploit Score: ||Access Complexity: |
|Impact Score: ||Authentication: |
| ||Confidentiality: |
| ||Integrity: |
| ||Availability: |