CVE-2020-35580

Katalog CVE

CVSS 7.5 · High EPSS 14,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada searchblox. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBlox configuration file (e.g., searchblox/WEB-INF/config.xml), which contains both the Super Admin's API key and the base64 encoded SHA1 password hashes of other SearchBlox users.

Rincian

Terbit di NVD

20 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

14,0% peluang dieksploitasi; lebih tinggi dari 96,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://developer.searchblox.com/docs/getting-started-with-searchblox advisory vendor
• https://hateshape.github.io/general/2021/05/11/CVE-2020-35580.html exploit · advisory pihak ketiga