CVE-2023-46851

    Dashboard / Vulnerabilities / CVE-2023-46851

    CVE-2023-46851

    Published: 7 Nov 2023Last Modified: 28 Oct 2026

    Summary: Apache Allura: sensitive information exposure via import

    Details: Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them.  Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution. This issue affects Apache Allura from 1.0.1 through 1.15.0. Users are recommended to upgrade to version 1.16.0, which fixes the issue.  If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.

    References: https://allura.apache.org/posts/2023-allura-1.16.0.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46851.json, https://lists.apache.org/thread/hqk0vltl7qgrq215zgwjfoj0khbov0gx, https://nvd.nist.gov/vuln/detail/CVE-2023-46851

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 924e0204706aeb5367e60df19ba38b26ac4474a3
    Fixed -705f6d38c47347113eb7b7032aa4932f4ef645bc

    Affected versions

    rel/1.15.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-46851 | CVE-DB