PT-2019-6372 · Mulesoft · Apikit+4
Published
2019-08-30
·
Updated
2022-05-24
·
CVE-2019-15630
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Mule Runtime versions 3.2.0 through 4.x
MuleSoft API Gateway versions prior to August 1, 2019
Description
The issue is related to directory traversal errors in the processing of relative paths to restricted directories. This can allow a remote attacker to gain unauthorized access to protected information. The vulnerability affects the APIkit, HTTP connector, and OAuth2 Provider components, enabling remote attackers to read files accessible to the Mule process.
Recommendations
For Mule Runtime versions 3.2.0 through 4.x, update to a version released after August 1, 2019.
For MuleSoft API Gateway versions prior to August 1, 2019, update to a version released after August 1, 2019.
As a temporary workaround, consider restricting access to the vulnerable APIkit, HTTP connector, and OAuth2 Provider components until a patch is available.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apikit
Http Connector
Mule Runtime
Mulesoft Api Gateway
Oauth2 Provider