CVE-2020-15230

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host as an application. Only applications using FileMiddleware are affected. This is fixed in version 4.29.4.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
vapor	vapor	< 4.29.4

References

https://github.com/vapor/vapor/commit/cf1651f7ff76515593f4d8ca6e6e15d2247fe255Patch, Third Party Advisory
https://github.com/vapor/vapor/pull/2500Third Party Advisory
https://github.com/vapor/vapor/security/advisories/GHSA-vcvg-xgr8-p5gqThird Party Advisory
https://github.com/vapor/vapor/commit/cf1651f7ff76515593f4d8ca6e6e15d2247fe255Patch, Third Party Advisory
https://github.com/vapor/vapor/pull/2500Third Party Advisory
https://github.com/vapor/vapor/security/advisories/GHSA-vcvg-xgr8-p5gqThird Party Advisory

Timeline

Published: Oct 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-152316.1In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.CVE-2020-152329.1In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.CVE-2020-152334.8ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is a CVE-2020-152344.8ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered CVE-2020-152357.5In RACTF before commit f3dc89b, unauthenticated users are able to get the value of sensitive config keys that would normally be hidden to ev CVE-2020-152367.5In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache f CVE-2020-152375.9In Shrine before version 3.3.0, when using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess CVE-2020-152387.0Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to CVE-2020-152393.5In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which ar CVE-2020-15247.8An elevation of privilege vulnerability exists when the Windows Speech Shell Components improperly handle memory. To exploit this vulnerabil CVE-2020-152409.1omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 improperly validate the JWT token signature when using the `jwt_validator.verify` me CVE-2020-152416.1TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-sit