Description
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
Remediation
References
https://fusionauth.io/docs/v1/tech/release-notes
https://github.com/FusionAuth/fusionauth-issues/issues/1983
Related Vulnerabilities
CVE-2022-45387 Vulnerability in maven package org.jenkins-ci.plugins:bart
CVE-2023-26136 Vulnerability in maven package org.webjars.bowergithub.salesforce:tough-cookie
CVE-2021-32685 Vulnerability in npm package tenvoy
CVE-2020-6428 Vulnerability in maven package org.webjars.npm:electron
CVE-2016-10735 Vulnerability in maven package org.webjars:bootstrap