CVE-2022-45921

{"id": "CVE-2022-45921", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-11-28T21:15:10.747", "references": [{"url": "https://fusionauth.io/docs/v1/tech/release-notes", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/FusionAuth/fusionauth-issues/issues/1983", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process."}, {"lang": "es", "value": "FusionAuth anterior a 1.41.3 permite ver o recuperar un archivo fuera del root de la aplicaci\u00f3n mediante una solicitud HTTP. Para ser espec\u00edfico, un atacante puede ver o recuperar cualquier archivo legible por el usuario que ejecuta el proceso FusionAuth."}], "lastModified": "2022-12-01T23:07:57.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fusionauth:fusionauth:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E1FF535-F9FA-4576-99AA-F43450B7229E", "versionEndExcluding": "1.41.3", "versionStartIncluding": "1.37.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}