Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-5685

Pre-Authorization Limited Arbitrary File Read in Crowd - CVE-2020-36240

XMLWordPrintable

    • 5.3
    • Medium
    • CVE-2020-36240

      The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

      Affected versions:

      • version < 4.0.4
      • 4.10.0 ≤ version < 4.1.2

      Fixed versions:

      • 4.0.4
      • 4.1.2

      This vulnerability is attributed to Amit Laish, a security researcher from GE Digital. 

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: