Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Apache Allura from 1.0.1 through 1.16.0. Users are recommended to upgrade to version 1.17.0, which fixes the issue. If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NApache Allura
APPApache1.0.1 – 1.17.0 (bez)
Powiązane podatności
Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Al...
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allu...
In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web a...
Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura...
XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before...