Path Traversal in Apache Commons Io
CVE-2021-29425
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.102 (95.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Apache Commons_io — versions 2.2, 2.3, 2.4
- Apache Software Foundation Commons Io — versions Apache Commons IO 2.2, Apache Commons IO 2.3, Apache Commons IO 2.4
- Netapp Active_iq_unified_manager
- Oracle Access_manager — versions 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0
- Oracle Agile_engineering_data_management — versions 6.2.1.0
- Oracle Agile_plm — versions 9.3.6
- Oracle Agile_product_lifecycle_management — versions 9.3.6
- Oracle Application_performance_management — versions 13.4.1.0, 13.5.1.0
- Oracle Application_testing_suite — versions 13.3.0.1
- Oracle Banking_apis — versions 18.1, 18.2, 18.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (Exploit, x_refsource_MISC, Issue Tracking, Vendor Advisory)
- security@apache.org (Mailing List, x_refsource_MISC, Vendor Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2021-29425?
- CVE-2021-29425 is a medium-severity vulnerability in Apache Commons Io, classified under Improper Input Validation. CVSS score: 4.8/10. Published 2021-04-13.
- How severe is CVE-2021-29425?
- Medium severity. CVSS v3 base score is 4.8 out of 10.
- Is CVE-2021-29425 known to be exploited?
- 24 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.