| Package | Affected versions | Patched versions |
|---|---|---|
| searchblox | < 9.2.2 | 9.2.2 |
A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBlox configuration file (e.g., searchblox/WEB-INF/config.xml), which contains both the Super Admin's API key and the base64 encoded SHA1 password hashes of other SearchBlox users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free