Platform
other
Component
allegra
Fixed in
7.5.1
CVE-2023-51639 is a critical directory traversal vulnerability discovered in Allegra, allowing attackers to bypass authentication and potentially access sensitive files. This flaw arises from inadequate validation of user-supplied paths within the downloadExportedChart action. Affected versions include 7.5.0.24 through 7.5.0.24, and a fix is available in version 7.5.1.
The impact of CVE-2023-51639 is severe due to the ease of exploitation and the potential for unauthorized access. An attacker can bypass authentication entirely, meaning no credentials are required to trigger the vulnerability. This allows them to traverse the file system and potentially download confidential data, modify system files, or execute arbitrary code if the underlying system has further vulnerabilities. The lack of authentication makes this vulnerability particularly concerning, as it significantly broadens the attack surface and lowers the barrier to entry for malicious actors. Successful exploitation could lead to a complete compromise of the Allegra installation and potentially the underlying server.
CVE-2023-51639 was publicly disclosed on November 22, 2024. The vulnerability was reported to ZDI (ZDI-CAN-22361). Given the ease of exploitation and the critical CVSS score, it is likely that public proof-of-concept exploits will emerge. Monitor security advisories and threat intelligence feeds for any indications of active exploitation campaigns. The vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.51% (66% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2023-51639 is to upgrade Allegra to version 7.5.1 or later, which contains the necessary fix. If immediate upgrading is not possible, consider implementing temporary workarounds. While a direct WAF rule is difficult without knowing the exact file paths being targeted, restricting access to the downloadExportedChart endpoint and implementing strict input validation on any file path parameters could offer some limited protection. Thoroughly review and restrict file system permissions to minimize the potential damage from a successful attack. After upgrading, confirm the vulnerability is resolved by attempting to access a file outside of the intended directory via the downloadExportedChart action; it should be denied.
Update Allegra to version 7.5.1 or later. This version corrects the authentication bypass and directory traversal vulnerability. See the release notes for 7.5.1 for more details about the update.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2023-51639 is a critical vulnerability in Allegra allowing attackers to bypass authentication and access files due to insufficient path validation. It affects versions 7.5.0.24–7.5.0.24.
You are affected if you are running Allegra versions 7.5.0.24 through 7.5.0.24. Check your version and upgrade immediately.
Upgrade Allegra to version 7.5.1 or later to resolve the vulnerability. If upgrading is not immediately possible, implement temporary workarounds like restricting access to the vulnerable endpoint.
While no active exploitation has been confirmed, the ease of exploitation and critical severity suggest it is likely to be targeted. Monitor security advisories and threat intelligence.
Refer to the Allegra security advisory for details and updates: [https://www.allegra.de/security-advisories/](https://www.allegra.de/security-advisories/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.