CVE-2019-13343

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...&h= substring followed by a filename.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bitbucket.org/account/user/butor-team/projects/PROJThird Party Advisory
https://bitbucket.org/butor-team/portal/commits/allThird Party Advisory
https://bitbucket.org/butor-team/portal/commits/cd7055d33e194fcf530100ee1d8d13aa9cde230bPatch, Third Party Advisory
https://bitbucket.org/butor-team/portal/src/cd7055d33e194fcf530100ee1d8d13aa9cde230b/src/main/java/com/butor/portal/web/servlet/WhiteLabelingServlet.java?at=masterExploit, Third Party Advisory
https://www.gosecure.net/blog/2019/09/30/butor-portal-arbitrary-file-download-vulnerability-cve-2019-13343Exploit, Third Party Advisory
https://bitbucket.org/account/user/butor-team/projects/PROJThird Party Advisory
https://bitbucket.org/butor-team/portal/commits/allThird Party Advisory
https://bitbucket.org/butor-team/portal/commits/cd7055d33e194fcf530100ee1d8d13aa9cde230bPatch, Third Party Advisory
https://bitbucket.org/butor-team/portal/src/cd7055d33e194fcf530100ee1d8d13aa9cde230b/src/main/java/com/butor/portal/web/servlet/WhiteLabelingServlet.java?at=masterExploit, Third Party Advisory
https://www.gosecure.net/blog/2019/09/30/butor-portal-arbitrary-file-download-vulnerability-cve-2019-13343Exploit, Third Party Advisory

Timeline

Published: Oct 2, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-133445.3An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to CVE-2019-133456.1The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.CVE-2019-133466.1In MyT 1.5.1, the User[username] parameter has XSS.CVE-2019-133477.5An issue was discovered in the SAML Single Sign On (SSO) plugin for several Atlassian products affecting versions 3.1.0 through 3.2.2 for Ji CVE-2019-133488.8In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in clearte CVE-2019-133494.9In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.CVE-2019-13357.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'C CVE-2019-133518.1posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descript CVE-2019-133529.8WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. CVE-2019-133549.8The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The cu CVE-2019-133557.8In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedu CVE-2019-133567.8In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ use