CVE-2020-35580
HIGH EXPLOITED NUCLEISearchblox < 9.2.2 - Path Traversal
Title source: ruleDescription
A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBlox configuration file (e.g., searchblox/WEB-INF/config.xml), which contains both the Super Admin's API key and the base64 encoded SHA1 password hashes of other SearchBlox users.
Nuclei Templates (1)
SearchBlox <9.2.2 - Local File Inclusion
HIGHby daffainfo
Scores
CVSS v3
7.5
EPSS
0.8342
EPSS Percentile
99.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
VulnCheck KEV
2023-11-13
CWE
CWE-22
Status
published
Products (1)
searchblox/searchblox
< 9.2.2
Published
May 20, 2021
Tracked Since
Feb 18, 2026