CVE-2023-51648

Summary

CVE-2023-51648 is a Directory Traversal Information Disclosure vulnerability affecting Allegra's getFileContentAsString method. This issue arises due to insufficient validation of user-supplied paths in file operations. As a result, remote attackers can exploit this vulnerability, which requires authentication, to disclose sensitive information, including stored credentials, on affected installations. The registration mechanism in Allegra can be manipulated to create a new user with suitable privileges, enabling the attack. ZDI-CAN-22530 reported this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.