Directory Traversal Vulnerability in MuleSoft Mule Runtime and API Gateway Components
CVE-2019-15630

7.5HIGH

Key Information:

Vendor

Salesforce, Inc.

Status
Mulesoft
Mulesoft Api Gateway
Vendor
CVE Published:
30 August 2019

What is CVE-2019-15630?

A directory traversal vulnerability exists in the APIkit, HTTP connector, and OAuth2 Provider components of MuleSoft Mule Runtime and MuleSoft API Gateway. This vulnerability enables remote attackers to access files that are otherwise restricted, potentially exposing sensitive data. The issue affects specific versions of Mule Runtime and API Gateway released prior to August 1, 2019, posing significant risks for organizations relying on these components for their API management and integration solutions.

Affected Version(s)

Mulesoft 3.x and 4.x released before August 1 2019

Mulesoft API Gateway All versions

References

https://help.salesforce.com/apex/HTViewSolution?urlname=C...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-15630 : Directory Traversal Vulnerability in MuleSoft Mule Runtime and API Gateway Components