Apache Allura versions up to 1.20.0 are vulnerable to an information exposure flaw that permits unauthenticated access to sensitive data.

This vulnerability is categorized as an exposure of sensitive information to an unauthorized actor (CWE-200). It occurs because the search function does not properly enforce access controls, allowing an unauthenticated remote attacker to retrieve restricted data.

The ability for unauthenticated users to query and retrieve non-public information poses a significant risk to data confidentiality. With a CVSS score of 7.5, this high-severity flaw could lead to the unauthorized disclosure of sensitive project data, internal communications, or intellectual property, potentially resulting in severe reputational damage and regulatory non-compliance.

Immediate Action: Upgrade Apache Allura to version 1.21.0 or later as recommended by the vendor.

Proactive Monitoring: Review web server and application access logs for unusual search queries or high volumes of requests originating from unauthorized IP addresses.

Compensating Controls: Implement WAF rules to detect and block suspicious patterns in search parameters that might indicate automated scraping of internal information.

Public Exploit Available: No — exploit_available (false).

Given the high severity of this information disclosure vulnerability, organizations should prioritize updating their Apache Allura instances to version 1.21.0 immediately. The lack of authentication requirements makes this an attractive target for automated discovery tools, necessitating swift remediation to prevent unauthorized data access.