Apache Allura

Apache Allura: Git command injection

Apache Allura: Server-side request forgery

In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura, such as Nginx, Apache/mod_wsgi or paster may prevent the attack from succeeding. Others, such as gunicorn do not prevent it and leave Allura vulnerable.

Apache Allura: sensitive information exposure via DNS rebinding

Apache Allura: Missing permission checks IDOR

In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a user engages with that dropdown on that page.

In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results may occur including XSS or service denial for the victim's browsing session.

Apache Allura: XSS in markdown pipeline

Apache Allura: XSS in code display

Apache Allura: Unauthenticated REST disclosure

Apache Allura: sensitive information exposure via import

Apache Allura: Stored authenticated XSS