CVE-2021-29425

ADVISORY - github

Summary

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

EPSS Score⁠: 0.00485 (0.654)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-20⁠

Improper Input Validation

CWE-22⁠

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADVISORY - github

CWE-20⁠

Improper Input Validation

CWE-22⁠

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADVISORY - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-22⁠

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-352⁠

Cross-Site Request Forgery (CSRF)

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

ADVISORY - redhat

CWE-22⁠

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Impacted images

Advisories

NIST

CREATED

5 years ago

UPDATED

1 year ago

ADVISORY IDCVE-2021-29425⁠

EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-20⁠CWE-22⁠

CVSS SCORE

4.8medium

GitHub

CREATED

5 years ago

UPDATED

2 years ago

ADVISORY IDGHSA-gwrp-pvrq-jmwv⁠

EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)

CWE-20⁠CWE-22⁠

CVSS SCORE

4.8medium

Debian

CREATED

5 years ago

UPDATED

8 days ago

ADVISORY IDCVE-2021-29425⁠

EXPLOITABILITY SCORE

-

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

5 years ago

UPDATED

1 year ago

ADVISORY IDCVE-2021-29425⁠

EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

4.8medium

GitLab

CREATED

5 years ago

UPDATED

2 years ago

ADVISORY ID

CVE-2021-29425

EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)

CWE-1035⁠CWE-22⁠CWE-352⁠CWE-937⁠

CVSS SCORE

4.8medium

Amazon

CREATED

3 years ago

UPDATED

3 years ago

ADVISORY IDALAS2-2023-2059⁠

EXPLOITABILITY SCORE

-

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Red Hat

CREATED

5 years ago

UPDATED

4 months ago

ADVISORY IDCVE-2021-29425⁠

EXPLOITABILITY SCORE

2.2

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)

CVSS SCORE

4.8medium

Chainguard

CREATED

4 months ago

UPDATED

4 months ago

ADVISORY ID

CGA-2266-xcqq-qpf4

EXPLOITABILITY SCORE

-

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

intheWild

CREATED

1 year ago

UPDATED

1 year ago

ADVISORY IDCVE-2021-29425⁠

EXPLOITABILITY SCORE

-

EXPLOITS FOUND

-

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY