Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2020-15097— Path Traversal in loklak

Quick assessment

Affected
loklak loklak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Loklak Server是Loklak团队的一个用于从多种来源收集文本信息的服务端应用。 loklak 存在路径遍历漏洞，该漏洞源于输入验证不足导致了目录遍历漏洞。攻击者可利用该漏洞可以检索托管文件系统上应用程序可读的任何管理配置和文件。

CVSS 9.1 · Critical EPSS 2.12% · P81
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-15097

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Path Traversal in loklak
Source: CVE Program / CVE List V5
Vulnerability Description
loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, a path traversal vulnerability exists. Insufficient input validation in the APIs exposed by the loklak server allowed a directory traversal vulnerability. Any admin configuration and files readable by the app available on the hosted file system can be retrieved by the attacker. Furthermore, user-controlled content could be written to any admin config and files readable by the application. This has been patched in commit 50dd692. Users will need to upgrade their hosted instances of loklak to not be vulnerable to this exploit.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
loklak 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Loklak Server是Loklak团队的一个用于从多种来源收集文本信息的服务端应用。 loklak 存在路径遍历漏洞，该漏洞源于输入验证不足导致了目录遍历漏洞。攻击者可利用该漏洞可以检索托管文件系统上应用程序可读的任何管理配置和文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
loklak loklak <= 5f48476d6f06dc00d87d25def5f789db703dfe3e -

II. Public POCs for CVE-2020-15097

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-15097

请登录查看更多情报信息。

Patches & Fixes for CVE-2020-15097 (1)

Vendor Advisories for CVE-2020-15097 (1)

IV. Related Vulnerabilities

Same weakness: CWE-22

V. Comments for CVE-2020-15097

No comments yet

Leave a comment