CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2022-45921
High (7.5) in fusionauth fusionauth. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in io.fusionauth:fusionauth-java-client 1.41.3.
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fusionauth:fusionauth
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rmcx-fg5w-x8j9 | Maven | io.fusionauth:fusionauth-java-client | >=1.37.0 <1.41.3 | 1.41.3 |