CVE-2020-35580 - CVE House
Back to Database
Status published High CVE-2020-35580

A local file inclusion vulnerability in the FileServlet in all...

Vulnerability Description

A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBlox configuration file (e.g., searchblox/WEB-INF/config.xml), which contains both the Super Admin's API key and the base64 encoded SHA1 password hashes of other SearchBlox users.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-35580

Credits & Attribution

No credits recorded in the NVD database.

References

More from searchblox

View All →
CVE-2018-11586
XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7...
Critical 9.8
CVE-2018-11538
servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1,...
High 8.8
CVE-2015-7919
SearchBlox 8.3 before 8.3.1 allows remote attackers to write to...
Critical 10
CVE-2015-3422
Cross-site scripting (XSS) vulnerability in SearchBlox before 8.2.1 allows remote...
Medium 4.3
CVE-2015-0970
Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows...
High 8.8

Affected Vendor

Affected Software

searchblox
Vulnerable Versions:
0

Timeline

Official Publish: May 20th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.