Uploaded image for project: 'Crowd'
  1. Crowd
  2. CWD-5685

Pre-Authorization Limited Arbitrary File Read in Crowd - CVE-2020-36240

    XMLWordPrintable

    Details

    • CVSS Score:
      5.3
    • CVSS Severity:
      Medium

      Description

      The ResourceDownloadRewriteRule class in Crowd before version 4.0.4, and from version 4.1.0 before 4.1.2 allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

      Affected versions:

      • version < 4.0.4
      • 4.10.0 ≤ version < 4.1.2

      Fixed versions:

      • 4.0.4
      • 4.1.2

      This vulnerability is attributed to Amit Laish, a security researcher from GE Digital. 

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              security-metrics-bot Security Metrics Bot
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: