Apache Allura
Monthly
Remote code and command injection in Apache Allura before 1.19.1 lets unauthenticated attackers smuggle attacker-controlled arguments into git command invocations through specially crafted inputs. Because Allura is a project-hosting and forge platform that shells out to git, this argument injection (CWE-88) can be leveraged to influence git behavior and, depending on the invoked subcommand, achieve command execution against the hosting server; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.18%).
Unauthenticated REST API disclosure in Apache Allura through version 1.19.1 exposes certain content items to unauthorized actors without any credentials. The vulnerability stems from insufficient access control on REST endpoints, allowing any network-accessible client to retrieve content that should require authentication. No public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier (unauthenticated, network-accessible) makes this a straightforward information leakage risk for any publicly exposed Allura instance.
Cross-site scripting in Apache Allura's Markdown rendering (versions 1.10.0 up to but not including 1.19.1) allows an attacker to inject script-related HTML into content that other users view, executing arbitrary JavaScript in their browsers. Because Allura is a collaborative forge where users routinely post Markdown in tickets, wiki pages, and comments, the payload is most likely stored and delivered to victims who open the affected page. No public exploit identified at time of analysis, and there is no CISA KEV listing or POC signal; the Apache PMC has released version 1.19.1 as the fix.
Cross-site scripting (XSS) in Apache Allura's code-display feature allows an attacker who can place crafted content into a rendered code view to execute arbitrary JavaScript in the browser of any user who views that code, in all versions before 1.19.1. Because Allura is forge/project-hosting software, a successful attack can hijack the sessions of project members or administrators. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Insecure Direct Object Reference (IDOR) in Apache Allura before 1.19.1 allows unauthorized access to multiple Artifact types due to missing server-side permission checks. Attackers who can interact with the platform can reference artifact objects directly by their identifiers and retrieve content beyond their authorization level, resulting in information disclosure across potentially broad artifact categories. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Remote code and command injection in Apache Allura before 1.19.1 lets unauthenticated attackers smuggle attacker-controlled arguments into git command invocations through specially crafted inputs. Because Allura is a project-hosting and forge platform that shells out to git, this argument injection (CWE-88) can be leveraged to influence git behavior and, depending on the invoked subcommand, achieve command execution against the hosting server; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.18%).
Unauthenticated REST API disclosure in Apache Allura through version 1.19.1 exposes certain content items to unauthorized actors without any credentials. The vulnerability stems from insufficient access control on REST endpoints, allowing any network-accessible client to retrieve content that should require authentication. No public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier (unauthenticated, network-accessible) makes this a straightforward information leakage risk for any publicly exposed Allura instance.
Cross-site scripting in Apache Allura's Markdown rendering (versions 1.10.0 up to but not including 1.19.1) allows an attacker to inject script-related HTML into content that other users view, executing arbitrary JavaScript in their browsers. Because Allura is a collaborative forge where users routinely post Markdown in tickets, wiki pages, and comments, the payload is most likely stored and delivered to victims who open the affected page. No public exploit identified at time of analysis, and there is no CISA KEV listing or POC signal; the Apache PMC has released version 1.19.1 as the fix.
Cross-site scripting (XSS) in Apache Allura's code-display feature allows an attacker who can place crafted content into a rendered code view to execute arbitrary JavaScript in the browser of any user who views that code, in all versions before 1.19.1. Because Allura is forge/project-hosting software, a successful attack can hijack the sessions of project members or administrators. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Insecure Direct Object Reference (IDOR) in Apache Allura before 1.19.1 allows unauthorized access to multiple Artifact types due to missing server-side permission checks. Attackers who can interact with the platform can reference artifact objects directly by their identifiers and retrieve content beyond their authorization level, resulting in information disclosure across potentially broad artifact categories. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.