Orta CVSS 4.8 PoC var

CVE-2021-29425: Commons Io: hatalı girdi doğrulama

Yayın: 13 Nisan 2021 10:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Özet bilgiler

Ürün: Apache Commons Io
CVSS v3.1: 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: %10,55 (yüzdelik 96)
CWE: CWE-20
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
apache-commons-io	2.2	2.2	—
apache-commons-io	2.3	2.3	—
apache-commons-io	2.4	2.4	—
apache-commons-io	2.5	2.5	—
apache-commons-io	2.6	2.6	—
debian-debian-linux	9.0	9.0	—
oracle-access-manager	11.1.2.3.0	11.1.2.3.0	—
oracle-access-manager	12.2.1.3.0	12.2.1.3.0	—
oracle-access-manager	12.2.1.4.0	12.2.1.4.0	—
oracle-agile-engineering-data-management	6.2.1.0	6.2.1.0	—
oracle-agile-product-lifecycle-management	9.3.6	9.3.6	—
oracle-application-performance-management	13.4.1.0	13.4.1.0	—
oracle-application-performance-management	13.5.1.0	13.5.1.0	—
oracle-application-testing-suite	13.3.0.1	13.3.0.1	—
oracle-banking-apis	18.1	18.1	—
oracle-banking-apis	18.2	18.2	—
oracle-banking-apis	18.3	18.3	—
oracle-banking-apis	19.1	19.1	—
oracle-banking-apis	19.2	19.2	—
oracle-banking-apis	20.1	20.1	—
oracle-banking-apis	21.1	21.1	—
oracle-banking-digital-experience	17.2	17.2	—
oracle-banking-digital-experience	18.1	18.1	—
oracle-banking-digital-experience	18.3	18.3	—
oracle-banking-digital-experience	19.1	19.1	—
oracle-banking-digital-experience	19.2	19.2	—
oracle-banking-digital-experience	20.1	20.1	—
oracle-banking-digital-experience	21.1	21.1	—
oracle-banking-enterprise-default-management	2.6.2	2.6.2	—
oracle-banking-enterprise-default-management	2.7.0	2.7.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları