Medium severity · published Apr 13, 2021
CVE-2021-29425
Possible limited path traversal vulnerabily in Apache Commons IO
4.8
CVSS
10.5%
EPSS
No
On KEV
Description
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.5% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
WebLogic Server · Oracle
12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 · source: NVD
AC
Apache Commons IO · Apache Software Foundation
Apache Commons IO 2.2; Apache Commons IO 2.3; Apache Commons IO 2.4; Apache Commons IO 2.5; Apache Commons IO 2.6 · source: vendor
AM
Access Manager · Oracle
11.1.2.3.0; 12.2.1.3.0; 12.2.1.4.0 · source: NVD
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
AE
Agile Engineering Data Management · Oracle
6.2.1.0 · source: NVD
AP
Agile Product Lifecycle Management · Oracle
9.3.6 · source: NVD
AP
Application Performance Management · Oracle
13.4.1.0; 13.5.1.0 · source: NVD
AT
Application Testing Suite · Oracle
13.3.0.1 · source: NVD
BA
Banking Apis · Oracle
18.1; 18.2; 18.3; 19.1; 19.2; 20.1; +1 more · source: NVD
BD
Banking Digital Experience · Oracle
17.2; 18.1; 18.3; 19.1; 19.2; 20.1; +1 more · source: NVD
BE
Banking Enterprise Default Management · Oracle
2.6.2; 2.7.0; 2.7.1; 2.10.0; 2.12.0 · source: NVD
BE
Banking Enterprise Default Managment · Oracle
2.3.0 through 2.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-29425
x_refsource_MISC
https://issues.apache.org/jira/browse/IO-556
x_refsource_MISC
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E
mailing-list
https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330%40%3Cdev.commons.apache.org%3E
mailing-list
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31%40%3Cdev.commons.apache.org%3E
mailing-list
https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04%40%3Ccommits.pulsar.apache.org%3E
mailing-list
https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436%40%3Ccommits.pulsar.apache.org%3E
More from WebLogic Server
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
9.8
CVE-2020-14750
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
9.8
CVE-2020-2883
Oracle WebLogic Server Unspecified Vulnerability