Description
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
Remediation
References
https://fusionauth.io/docs/v1/tech/release-notes
https://github.com/FusionAuth/fusionauth-issues/issues/1983
Related Vulnerabilities
CVE-2022-42890 Vulnerability in maven package org.apache.xmlgraphics:batik-script
CVE-2023-0868 Vulnerability in maven package org.opennms:opennms-webapp
CVE-2022-36099 Vulnerability in maven package org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki
CVE-2021-3820 Vulnerability in npm package i
CVE-2019-18212 Vulnerability in maven package org.lsp4xml:org.eclipse.lsp4xml.extensions.emmet