5.8
CVE-2021-29425
- EPSS 10.23%
- Veröffentlicht 13.04.2021 07:15:12
- Zuletzt bearbeitet 07.10.2026 19:17:25
- Erkennungen
LoginPossible limited path traversal vulnerabily in Apache Commons IO
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Commons Io Version 2.2 Update -
Apache ≫ Commons Io Version 2.3 Update -
Apache ≫ Commons Io Version 2.4 Update -
Apache ≫ Commons Io Version 2.5 Update -
Apache ≫ Commons Io Version 2.6 Update -
Debian ≫ Debian Linux Version 9.0
Oracle ≫ Access Manager Version 11.1.2.3.0
Oracle ≫ Access Manager Version 12.2.1.3.0
Oracle ≫ Access Manager Version 12.2.1.4.0
Oracle ≫ Agile Engineering Data Management Version 6.2.1.0
Oracle ≫ Agile Product Lifecycle Management Version 9.3.6
Oracle ≫ Application Performance Management Version 13.4.1.0
Oracle ≫ Application Performance Management Version 13.5.1.0
Oracle ≫ Application Testing Suite Version 13.3.0.1
Oracle ≫ Banking Apis Version 18.1
Oracle ≫ Banking Apis Version 18.2
Oracle ≫ Banking Apis Version 18.3
Oracle ≫ Banking Apis Version 19.1
Oracle ≫ Banking Apis Version 19.2
Oracle ≫ Banking Apis Version 20.1
Oracle ≫ Banking Apis Version 21.1
Oracle ≫ Banking Digital Experience Version 17.2
Oracle ≫ Banking Digital Experience Version 18.1
Oracle ≫ Banking Digital Experience Version 18.3
Oracle ≫ Banking Digital Experience Version 19.1
Oracle ≫ Banking Digital Experience Version 19.2
Oracle ≫ Banking Digital Experience Version 20.1
Oracle ≫ Banking Digital Experience Version 21.1
Oracle ≫ Banking Enterprise Default Management Version 2.6.2
Oracle ≫ Banking Enterprise Default Management Version 2.7.0
Oracle ≫ Banking Enterprise Default Management Version 2.7.1
Oracle ≫ Banking Enterprise Default Management Version 2.10.0
Oracle ≫ Banking Enterprise Default Management Version 2.12.0
Oracle ≫ Banking Enterprise Default Managment Version >= 2.3.0 <= 2.4.0
Oracle ≫ Banking Party Management Version 2.7.0
Oracle ≫ Banking Platform Version >= 2.3.0 <= 2.4.1
Oracle ≫ Banking Platform Version 2.6.2
Oracle ≫ Banking Platform Version 2.7.0
Oracle ≫ Banking Platform Version 2.7.1
Oracle ≫ Blockchain Platform Version < 21.1.2
Oracle ≫ Commerce Guided Search Version 11.3.2
Oracle ≫ Communications Application Session Controller Version 3.9.0
Oracle ≫ Communications Cloud Native Core Network Repository Function Version 1.14.0
Oracle ≫ Communications Cloud Native Core Policy Version 1.14.0
Oracle ≫ Communications Cloud Native Core Unified Data Repository Version 1.4.0
Oracle ≫ Communications Contacts Server Version 8.0.0.6.0
Oracle ≫ Communications Convergence Version 3.0.2.2.0
Oracle ≫ Communications Design Studio Version >= 7.4.0 <= 7.4.2
Oracle ≫ Communications Design Studio Version 7.3.5
Oracle ≫ Communications Diameter Intelligence Hub Version >= 8.0.0 <= 8.1.0
Oracle ≫ Communications Diameter Intelligence Hub Version >= 8.2.0 <= 8.2.3
Oracle ≫ Communications Interactive Session Recorder Version 6.3
Oracle ≫ Communications Interactive Session Recorder Version 6.4
Oracle ≫ Communications Offline Mediation Controller Version 12.0.0.3
Oracle ≫ Communications Order And Service Management Version 7.3
Oracle ≫ Communications Order And Service Management Version 7.4
Oracle ≫ Communications Policy Management Version 12.5.0.0.0
Oracle ≫ Communications Pricing Design Center Version 12.0.0.4.0
Oracle ≫ Communications Pricing Design Center Version 12.0.0.5.0
Oracle ≫ Communications Service Broker Version 6.2
Oracle ≫ Enterprise Communications Broker Version 3.3
Oracle ≫ Enterprise Session Border Controller Version 8.4
Oracle ≫ Enterprise Session Border Controller Version 9.0
Oracle ≫ Financial Services Analytical Applications Infrastructure Version >= 8.0.7 <= 8.1.1
Oracle ≫ Financial Services Model Management And Governance Version >= 8.0.8 <= 8.1.1
Oracle ≫ Flexcube Core Banking Version >= 11.6.0 <= 11.8.0
Oracle ≫ Flexcube Core Banking Version 5.2.0
Oracle ≫ Flexcube Core Banking Version 11.10.0
Oracle ≫ Fusion Middleware Mapviewer Version 12.2.1.4.0
Oracle ≫ Health Sciences Data Management Workbench Version 2.5.2.1
Oracle ≫ Health Sciences Data Management Workbench Version 3.0.0.0
Oracle ≫ Health Sciences Information Manager Version >= 3.0.1 <= 3.0.4
Oracle ≫ Healthcare Data Repository Version 8.1.0
Oracle ≫ Insurance Policy Administration Version 11.0.2
Oracle ≫ Insurance Policy Administration Version 11.1.0
Oracle ≫ Insurance Policy Administration Version 11.2.8
Oracle ≫ Insurance Policy Administration Version 11.3.0
Oracle ≫ Insurance Policy Administration Version 11.3.1
Oracle ≫ Insurance Rules Palette Version 11.0.2
Oracle ≫ Insurance Rules Palette Version 11.1.0
Oracle ≫ Insurance Rules Palette Version 11.2.8
Oracle ≫ Insurance Rules Palette Version 11.3.0
Oracle ≫ Insurance Rules Palette Version 11.3.1
Oracle ≫ Oss Support Tools Version < 2.12.42
Oracle ≫ Primavera Unifier Version >= 17.7 <= 17.12
Oracle ≫ Primavera Unifier Version 18.8
Oracle ≫ Primavera Unifier Version 19.12
Oracle ≫ Primavera Unifier Version 20.12
Oracle ≫ Primavera Unifier Version 21.12
Oracle ≫ Real User Experience Insight Version 13.4.1.0
Oracle ≫ Real User Experience Insight Version 13.5.1.0
Oracle ≫ Rest Data Services SwEdition - Version < 21.2
Oracle ≫ Rest Data Services Version 21.3 SwEdition -
Oracle ≫ Retail Assortment Planning Version 16.0.3
Oracle ≫ Retail Integration Bus Version >= 16.0.1 <= 16.0.3
Oracle ≫ Retail Integration Bus Version 13.0
Oracle ≫ Retail Integration Bus Version 14.1.3.0
Oracle ≫ Retail Integration Bus Version 14.1.3.2
Oracle ≫ Retail Integration Bus Version 15.0.3.1
Oracle ≫ Retail Integration Bus Version 19.0.0
Oracle ≫ Retail Integration Bus Version 19.0.1
Oracle ≫ Retail Merchandising System Version 16.0.3
Oracle ≫ Retail Merchandising System Version 19.0.1
Oracle ≫ Retail Order Broker Version 16.0
Oracle ≫ Retail Order Broker Version 18.0
Oracle ≫ Retail Order Broker Version 19.1
Oracle ≫ Retail Pricing Version 19.0.1
Oracle ≫ Retail Service Backbone Version >= 16.0.1 <= 16.0.3
Oracle ≫ Retail Service Backbone Version 14.1.3.0
Oracle ≫ Retail Service Backbone Version 14.1.3.2
Oracle ≫ Retail Service Backbone Version 15.0.3.1
Oracle ≫ Retail Service Backbone Version 19.0.0
Oracle ≫ Retail Service Backbone Version 19.0.1
Oracle ≫ Retail Size Profile Optimization Version 16.0.3
Oracle ≫ Retail Xstore Point Of Service Version 17.0.4
Oracle ≫ Retail Xstore Point Of Service Version 18.0.3
Oracle ≫ Retail Xstore Point Of Service Version 19.0.2
Oracle ≫ Retail Xstore Point Of Service Version 20.0.1
Oracle ≫ Solaris Cluster Version 4.0
Oracle ≫ Utilities Testing Accelerator Version 6.0.0.1.1
Oracle ≫ Utilities Testing Accelerator Version 6.0.0.2.2
Oracle ≫ Utilities Testing Accelerator Version 6.0.0.3.1
Oracle ≫ Webcenter Portal Version 12.2.1.3.0
Oracle ≫ Webcenter Portal Version 12.2.1.4.0
Oracle ≫ Weblogic Server Version 12.1.3.0.0
Oracle ≫ Weblogic Server Version 12.2.1.3.0
Oracle ≫ Weblogic Server Version 12.2.1.4.0
Oracle ≫ Weblogic Server Version 14.1.1.0.0
Netapp ≫ Active Iq Unified Manager Version - SwPlatform linux
Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere
Netapp ≫ Active Iq Unified Manager Version - SwPlatform windows
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 10.23% | 0.952 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.8 | 2.2 | 2.5 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
|
| NIST | 5.8 | 8.6 | 4.9 |
AV:N/AC:M/Au:N/C:P/I:P/A:N
|
| CISA-ADP | 6.5 | 3.9 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html
https://security.netapp.com/advisory/ntap-20220210-0004/
https://issues.apache.org/jira/browse/IO-556
https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34%40%3Cdev.myfaces.apache.org%3E
https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19%40%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e%40%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a%40%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2%40%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2%40%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401%40%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b%40%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c%40%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375%40%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04%40%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29%40%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31%40%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8%40%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5%40%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5%40%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80%40%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0%40%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af%40%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c%40%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d%40%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330%40%3Cdev.commons.apache.org%3E