Apache

Allura

11 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2026-73237

  • EPSS 0.43%
  • Veröffentlicht 12.08.2026 16:42:27
  • Zuletzt bearbeitet 17.08.2026 19:10:03

XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

6.1

CVE-2026-73238

  • EPSS 0.43%
  • Veröffentlicht 12.08.2026 16:41:58
  • Zuletzt bearbeitet 17.08.2026 19:09:53

XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

6.5

CVE-2026-73239

  • EPSS 0.34%
  • Veröffentlicht 12.08.2026 16:41:41
  • Zuletzt bearbeitet 17.08.2026 19:09:42

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

9.8

CVE-2026-73240

  • EPSS 0.54%
  • Veröffentlicht 12.08.2026 16:41:19
  • Zuletzt bearbeitet 17.08.2026 19:08:51

Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

9.1

CVE-2026-69223

  • EPSS 0.73%
  • Veröffentlicht 11.08.2026 17:03:04
  • Zuletzt bearbeitet 17.08.2026 19:09:32

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

4.8

CVE-2024-38379

  • EPSS 0.69%
  • Veröffentlicht 22.06.2024 09:15:09
  • Zuletzt bearbeitet 19.03.2025 15:15:47

Apache Allura's neighborhood settings are vulnerable to a stored XSS attack.  Only neighborhood admins can access these settings, so the scope of risk is limited to configurations where neighborhood admins are not fully trusted. This issue affects A...

7.5

CVE-2024-36471

  • EPSS 0.75%
  • Veröffentlicht 10.06.2024 22:15:11
  • Zuletzt bearbeitet 15.07.2025 16:36:48

Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL.  Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Ap...

4.9

CVE-2023-46851

  • EPSS 1.65%
  • Veröffentlicht 07.11.2023 09:15:07
  • Zuletzt bearbeitet 21.11.2024 08:29:25

Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them.  Exposing internal files then can lead to ...

6.1

CVE-2019-10085

  • EPSS 5.14%
  • Veröffentlicht 19.06.2019 00:15:12
  • Zuletzt bearbeitet 21.11.2024 04:18:22

In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a user engages with that dropdown on that page.

6.1

CVE-2018-1319

  • EPSS 2.2%
  • Veröffentlicht 15.03.2018 20:29:00
  • Zuletzt bearbeitet 21.11.2024 03:59:37

In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results may occur including XSS or service denial for the victim's browsing session.