CVE-2020-15230highCWE-22

CVE-2020-15230: high-severity vulnerability in vapor

Arbitrary file read un Vapor

Published · Updated

Follow this CVE+ Monitor vapor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 1.5%
In short

Vapor web framework versions before 4.29.4 have a flaw in FileMiddleware that allows attackers to read any file on the server by manipulating file paths. This is dangerous because attackers can access sensitive data like configuration files or private keys.

Technical detail

Path traversal vulnerability in Vapor's FileMiddleware (CWE-22) allows unauthenticated attackers to bypass directory restrictions and read arbitrary files on the filesystem. The vulnerability requires only that FileMiddleware is enabled; exploitation occurs through crafted requests with path traversal sequences that are not properly sanitized before file access.

Summary generated and translated by AI from the official description.
Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N
Affected products
vapor · vapor
Related CVEs — vapor

In the same product, most dangerous first.

CVE-2022-31005HIGHInteger Overflow in Vapor's HTTP Range RequestEPSS 2.1%CVE-2021-21328MEDIUMDenial of ServiceEPSS 1.8%CVE-2022-31019HIGHDoS Vulnerability in URLEncodedFormDecoder in VaporEPSS 1.7%CVE-2021-32742HIGHUntrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crashEPSS 1.2%CVE-2023-44386MEDIUMIncorrect request error handling triggers server crash in VaporEPSS 0.7%CVE-2024-21631MEDIUMInteger overflow in URI leading to potential host spoofingEPSS 0.6%