What’s Vulnerable › Vulnerabilities

CVE-2020-35580

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-05-20 · updated 2026-06-17
• Weakness: CWE-22

Description

A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBlox configuration file (e.g., searchblox/WEB-INF/config.xml), which contains both the Super Admin's API key and the base64 encoded SHA1 password hashes of other SearchBlox users.

Affected products

• SearchBlox: before 9.2.2 — fixed in 9.2.2

How to fix

Upgrade to a fixed version: SearchBlox 9.2.2. Check the vendor advisory for mitigations.

References

• https://developer.searchblox.com/docs/getting-started-with-searchblox
• https://hateshape.github.io/general/2021/05/11/CVE-2020-35580.html
• https://developer.searchblox.com/docs/getting-started-with-searchblox
• https://hateshape.github.io/general/2021/05/11/CVE-2020-35580.html

Get alerted when CVE-2020-35580 or the next vulnerability affects your stack