CVE-2019-15630 - Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process

Back Back to CVE browser

HIGH

Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process

Published Aug 30, 2019

7.5

HIGH

CVSS 3.0

EPSS 3.00%

Description

Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow remote attackers to read files accessible to the Mule process.

Affected products

Vendor Salesforce, Inc. Product Mulesoft Default
n/a
- Version
  3.x and 4.x released before August 1 2019
  Status
  affected
  Constraints
  -
Vendor Salesforce, Inc. Product Mulesoft API Gateway Default
n/a
- Version
  All versions
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Salesforce, Inc.

Mulesoft

n/a

Version	Status	Constraints
3.x and 4.x released before August 1 2019	affected	-

Salesforce, Inc.

Mulesoft API Gateway

n/a

Version	Status	Constraints
All versions	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

Link	Providers	Tags
https://github.com/advisories/GHSA-mwh9-gr45-xvv4		Advisory
https://help.mulesoft.com/s/article/Directory-traversal-vulnerability-affecting-runtimes-of-MuleSoft-customers-running-certain-use-cases-of-Mule-flows-and-API-Gateways
https://help.salesforce.com/apex/HTViewSolution?urlname=CVE-2019-15630-Directory-Traversal-in-MuleSoft-Runtime&language=en_US		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-15630