Description
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
Remediation
References
https://fusionauth.io/docs/v1/tech/release-notes
https://github.com/FusionAuth/fusionauth-issues/issues/1983
Related Vulnerabilities
CVE-2023-35160 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates
CVE-2019-10298 Vulnerability in maven package org.jenkins-ci.plugins:koji
CVE-2020-2168 Vulnerability in maven package org.jenkins-ci.plugins:azure-acs
CVE-2022-41251 Vulnerability in maven package org.jenkins-ci.plugins:apprenda
CVE-2021-23425 Vulnerability in npm package trim-off-newlines