CVE-2020-35580
High
Description
A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBlox configuration file (e.g., searchblox/WEB-INF/config.xml), which contains both the Super Admin's API key and the base64 encoded SHA1 password hashes of other SearchBlox users.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSearchblox
PublishedMay 20, 2021
First seenMay 20, 2021
How to fix
Update
- searchblox searchblox9.2.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| searchblox searchblox | v < 9.2.2 | 9.2.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.