Test ID:	1.3.6.1.4.1.25623.1.0.810252
Category:	Web application abuses
Title:	Apache Tika Server 'fileUrl' Header Information Disclosure Vulnerability
Summary:	Apache Tika Server is prone to an information disclosure vulnerability.
Description:	Summary: Apache Tika Server is prone to an information disclosure vulnerability. Vulnerability Insight: The flaw is due to it provides optional functionality to run itself as a web service to allow remote use. When used in this manner, it is possible for a 3rd party to pass a 'fileUrl' header to the Apache Tika Server (tika-server). Vulnerability Impact: Successful exploitation will allow a remote attacker to read arbitrary files, this could be used to return sensitive content from the server machine. Affected Software/OS: Apache Tika Server 1.9 Solution: Upgrade to Apache Tika Server 1.10 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-3271 95020 http://www.securityfocus.com/bid/95020 [oss-security] 20150813 [CVE-2015-3271] Apache Tika information disclosure vulnerability http://www.openwall.com/lists/oss-security/2015/08/13/5 [tika-dev] 20150813 [CVE-2015-3271] Apache Tika information disclosure vulnerability https://lists.apache.org/thread.html/d2b3e7afb0251fac95fdee9817423cbc91e3d99a848c25a51d91c1e8%401439485507%40%3Cdev.tika.apache.org%3E
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.