Threats affecting pkg:maven/org.apache.allura/allura

9 threats

Severity	CVSS	Signals	Threat	Source	Published
High	–	EPSS 0.2%	CVE-2026-118196Apache Allura · OAuth 1 rebinding vulnerability HighEPSS 0.2%2026-11-09GCVE DatabaseCVE-2026-118196 An OAuth 1 rebinding vulnerability exists in Apache Allura versions through 1.22.0. This security flaw has been addressed in version 1.22.1, which users are advised to upgrade to in order to mitigate the issue. EPSS 0.2%Report on CVE-2026-118196 Vulnerability CWE-863 #ghsa-jcr4-cf4x-qrxg	GCVE Database	2026-11-09
Critical	9.1	EPSS 0.3%	CVE-2026-92120Apache Allura · Authentication Bypass by Capture-replay Critical9.1EPSS 0.3%2026-10-12CVE Database V5CVE-2026-92120 CVE-2026-92120 is a critical authentication bypass vulnerability in Apache Allura affecting versions up to 1.21.0. It involves an OAuth1 request replay attack that allows unauthorized access. The issue is fixed in version 1.22.0, which users are strongly advised to upgrade to. EPSS 0.3%Vulnerability Apache Software Foundation CWE-294 #ghsa-ccrf-jfj2-x65f	CVE Database V5	2026-10-12
Critical	9.1	EPSS 0.3%	CVE-2026-92119Apache Allura · Mass Assignment Critical9.1EPSS 0.3%2026-10-12CVE Database V5CVE-2026-92119 CVE-2026-92119 is a critical REST API mass assignment vulnerability in Apache Allura affecting versions up to 1.21.0. It allows improper modification of dynamically-determined object attributes. The issue is fixed in version 1.22.0. EPSS 0.3%Vulnerability Apache Software Foundation CWE-915 #ghsa-fc7h-2757-8pc7	CVE Database V5	2026-10-12
Critical	9.1	EPSS 0.3%	CVE-2026-92116Apache Allura · Open Redirect Critical9.1EPSS 0.3%2026-10-12CVE Database V5CVE-2026-92116 CVE-2026-92116 is a critical OAuth1 callback validation vulnerability in Apache Allura up to version 1.21.0. It is an open redirect issue (CWE-601) that allows redirection to untrusted sites. The vulnerability is fixed in Apache Allura version 1.22.0. EPSS 0.3%Vulnerability Apache Software Foundation CWE-601 #ghsa-6j5w-w523-6q83	CVE Database V5	2026-10-12
Medium	5.3	EPSS 0.6%	CVE-2026-75099Apache Allura · Information Exposure Medium5.3EPSS 0.6%2026-08-24CVE Database V5CVE-2026-75099 Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1.20.0, which fixes the issue. EPSS 0.6%Vulnerability Apache Software Foundation CWE-200	CVE Database V5	2026-08-24
Medium	6.1	EPSS 0.8%	CVE-2026-73237Apache Allura · Basic XSS Medium6.1EPSS 0.8%2026-08-12CVE Database V5CVE-2026-73237 XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue. EPSS 0.8%Vulnerability Apache Software Foundation CWE-80	CVE Database V5	2026-08-12
Medium	6.1	EPSS 0.8%	CVE-2026-73238Apache Allura · Basic XSS Medium6.1EPSS 0.8%2026-08-12CVE Database V5CVE-2026-73238 XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue. EPSS 0.8%Vulnerability Apache Software Foundation CWE-80	CVE Database V5	2026-08-12
Medium	6.5	EPSS 0.6%	CVE-2026-73239Apache Allura · Improper Handling of Insufficient Permissions or Privileges Medium6.5EPSS 0.6%2026-08-12CVE Database V5CVE-2026-73239 Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue. EPSS 0.6%Vulnerability Apache Software Foundation CWE-280 #ghsa-mjpp-gw39-h7mj	CVE Database V5	2026-08-12
Critical	9.1	EPSS 0.8%	CVE-2026-69223Apache Allura · Server-Side Request Forgery (SSRF) Critical9.1EPSS 0.8%2026-08-11CVE Database V5CVE-2026-69223 Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue. EPSS 0.8%Vulnerability Apache Software Foundation CWE-918	CVE Database V5	2026-08-11

Page 1 of 1 · 1 duplicate CVE record merged