Apache Allura vulnerabilities

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). The issue affects versions through 1.20.0 and is fixed in version 1.21.0.

Specifically crafted inputs may lead to git argument injection in Apache Allura before version 1.19.1.

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects versions before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue.

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.

REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

Apache Allura through version 1.20.0 is vulnerable to stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers.

Apache Allura through version 1.20.0 has a vulnerability that exposes non-public information via search. The issue is fixed in version 1.21.0.

Apache Allura through version 1.20.0 has a stored XSS vulnerability via markdown HTML processing. The issue is fixed in version 1.21.0.

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura through 1.19.1.

Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura before version 1.19.1.

XSS vulnerability in code display in Apache Allura before version 1.19.1.

XSS vulnerability in Markdown handling in Apache Allura from version 1.10.0 before 1.19.1.