CVE-2021-29425

MEDIUM4.8

Description

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected products

apache / commons_io2.2 – 2.2
apache / commons_io2.3 – 2.3
apache / commons_io2.4 – 2.4
apache / commons_io2.5 – 2.5
apache / commons_io2.6 – 2.6
Apache Software Foundation / Apache Commons IOApache Commons IO 2.5 – Apache Commons IO 2.5
Apache Software Foundation / Apache Commons IOApache Commons IO 2.4 – Apache Commons IO 2.4
Apache Software Foundation / Apache Commons IOApache Commons IO 2.3 – Apache Commons IO 2.3
Apache Software Foundation / Apache Commons IOApache Commons IO 2.6 – Apache Commons IO 2.6
Apache Software Foundation / Apache Commons IOApache Commons IO 2.2 – Apache Commons IO 2.2
debian / debian_linux9.0 – 9.0
NETAPP / active_iq_unified_manager
NETAPP / active_iq_unified_manager
NETAPP / active_iq_unified_manager
oracle / access_manager12.2.1.4.0 – 12.2.1.4.0
oracle / access_manager11.1.2.3.0 – 11.1.2.3.0
oracle / access_manager12.2.1.3.0 – 12.2.1.3.0
oracle / agile_engineering_data_management6.2.1.0 – 6.2.1.0
oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
oracle / application_performance_management13.5.1.0 – 13.5.1.0
oracle / application_performance_management13.4.1.0 – 13.4.1.0
oracle / Application Testing Suite13.3.0.1 – 13.3.0.1
oracle / banking_apis19.1 – 19.1
oracle / banking_apis19.2 – 19.2
oracle / banking_apis20.1 – 20.1
oracle / banking_apis21.1 – 21.1
oracle / banking_apis18.3 – 18.3
oracle / banking_apis18.2 – 18.2
oracle / banking_apis18.1 – 18.1
oracle / banking_digital_experience19.1 – 19.1
oracle / banking_digital_experience19.2 – 19.2
oracle / banking_digital_experience20.1 – 20.1
oracle / banking_digital_experience21.1 – 21.1
oracle / banking_digital_experience17.2 – 17.2
oracle / banking_digital_experience18.1 – 18.1
oracle / banking_digital_experience18.3 – 18.3
oracle / banking_enterprise_default_management2.10.0 – 2.10.0
oracle / banking_enterprise_default_management2.6.2 – 2.6.2
oracle / banking_enterprise_default_management2.7.0 – 2.7.0
oracle / banking_enterprise_default_management2.7.1 – 2.7.1
oracle / banking_enterprise_default_management2.12.0 – 2.12.0
oracle / banking_enterprise_default_managment2.3.0 – 2.4.0
oracle / banking_party_management2.7.0 – 2.7.0
oracle / banking_platform2.7.1 – 2.7.1
oracle / banking_platform2.6.2 – 2.6.2
oracle / banking_platform2.7.0 – 2.7.0
oracle / banking_platform2.3.0 – 2.4.1
oracle / blockchain_platform21.1.2
oracle / commerce_guided_search11.3.2 – 11.3.2
oracle / communications_application_session_controller3.9.0 – 3.9.0
oracle / communications_billing_and_revenue_management_elastic_charging_engine11.3 – 11.3
oracle / communications_billing_and_revenue_management_elastic_charging_engine12.0 – 12.0
oracle / communications_cloud_native_core_network_repository_function1.14.0 – 1.14.0
oracle / communications_cloud_native_core_policy1.14.0 – 1.14.0
oracle / communications_cloud_native_core_unified_data_repository1.4.0 – 1.4.0
oracle / communications_contacts_server8.0.0.6.0 – 8.0.0.6.0
oracle / communications_converged_application_server_-_service_controller6.2 – 6.2
oracle / communications_convergence3.0.2.2.0 – 3.0.2.2.0
oracle / communications_design_studio7.3.5 – 7.3.5
oracle / communications_design_studio7.4.0 – 7.4.2
oracle / communications_diameter_intelligence_hub8.0.0 – 8.1.0
oracle / communications_interactive_session_recorder6.4 – 6.4
oracle / communications_interactive_session_recorder6.3 – 6.3
oracle / communications_offline_mediation_controller12.0.0.3 – 12.0.0.3
oracle / communications_order_and_service_management7.4 – 7.4
oracle / communications_order_and_service_management7.3 – 7.3
oracle / communications_policy_management12.5.0.0.0 – 12.5.0.0.0
oracle / communications_pricing_design_center12.0.0.4.0 – 12.0.0.4.0
oracle / communications_pricing_design_center12.0.0.5.0 – 12.0.0.5.0
oracle / communications_service_broker6.2 – 6.2
oracle / enterprise_communications_broker3.3 – 3.3
oracle / enterprise_session_border_controller9.0 – 9.0
oracle / enterprise_session_border_controller8.4 – 8.4
oracle / financial_services_analytical_applications_infrastructure8.0.7 – 8.1.1
oracle / financial_services_model_management_and_governance8.0.8 – 8.1.1
oracle / FLEXCUBE Core Banking11.10.0 – 11.10.0
oracle / FLEXCUBE Core Banking5.2.0 – 5.2.0
oracle / FLEXCUBE Core Banking11.6.0 – 11.8.0
oracle / fusion_middleware_mapviewer12.2.1.4.0 – 12.2.1.4.0
oracle / healthcare_data_repository8.1.0 – 8.1.0
oracle / health_sciences_data_management_workbench3.0.0.0 – 3.0.0.0
oracle / health_sciences_data_management_workbench2.5.2.1 – 2.5.2.1
oracle / health_sciences_information_manager3.0.1 – 3.0.4
oracle / helidon1.4.7 – 1.4.7
oracle / helidon2.2.0 – 2.2.0
oracle / insurance_policy_administration11.3.0 – 11.3.0
oracle / insurance_policy_administration11.3.1 – 11.3.1
oracle / insurance_policy_administration11.1.0 – 11.1.0
oracle / insurance_policy_administration11.2.8 – 11.2.8
oracle / insurance_policy_administration11.0.2 – 11.0.2
oracle / insurance_rules_palette11.3.0 – 11.3.0
oracle / insurance_rules_palette11.3.1 – 11.3.1
oracle / insurance_rules_palette11.0.2 – 11.0.2
oracle / insurance_rules_palette11.1.0 – 11.1.0
oracle / insurance_rules_palette11.2.8 – 11.2.8
oracle / oss_support_tools2.12.42
oracle / primavera_unifier20.12 – 20.12
oracle / primavera_unifier21.12 – 21.12
oracle / primavera_unifier19.12 – 19.12
oracle / primavera_unifier17.7 – 17.12
oracle / primavera_unifier18.8 – 18.8
oracle / real_user_experience_insight13.4.1.0 – 13.4.1.0
oracle / real_user_experience_insight13.5.1.0 – 13.5.1.0
oracle / rest_data_services21.3 – 21.3
oracle / rest_data_services21.2
oracle / retail_assortment_planning16.0.3 – 16.0.3
oracle / retail_integration_bus15.0.3.1 – 15.0.3.1
oracle / retail_integration_bus16.0.1 – 16.0.3
oracle / retail_integration_bus13.0 – 13.0
oracle / retail_integration_bus14.1.3.0 – 14.1.3.0
oracle / retail_integration_bus14.1.3.2 – 14.1.3.2
oracle / retail_integration_bus19.0.0 – 19.0.0
oracle / retail_integration_bus19.0.1 – 19.0.1
oracle / retail_merchandising_system16.0.3 – 16.0.3
oracle / retail_merchandising_system19.0.1 – 19.0.1
oracle / retail_order_broker18.0 – 18.0
oracle / retail_order_broker19.1 – 19.1
oracle / retail_order_broker16.0 – 16.0
oracle / retail_pricing19.0.1 – 19.0.1
oracle / retail_service_backbone15.0.3.1 – 15.0.3.1
oracle / retail_service_backbone19.0.0 – 19.0.0
oracle / retail_service_backbone19.0.1 – 19.0.1
oracle / retail_service_backbone14.1.3.2 – 14.1.3.2
oracle / retail_service_backbone16.0.1 – 16.0.3
oracle / retail_service_backbone14.1.3.0 – 14.1.3.0
oracle / retail_size_profile_optimization16.0.3 – 16.0.3
oracle / retail_xstore_point_of_service20.0.1 – 20.0.1
oracle / retail_xstore_point_of_service19.0.2 – 19.0.2
oracle / retail_xstore_point_of_service17.0.4 – 17.0.4
oracle / retail_xstore_point_of_service18.0.3 – 18.0.3
oracle / solaris_cluster4.0 – 4.0
oracle / utilities_testing_accelerator6.0.0.3.1 – 6.0.0.3.1
oracle / utilities_testing_accelerator6.0.0.1.1 – 6.0.0.1.1
oracle / utilities_testing_accelerator6.0.0.2.2 – 6.0.0.2.2
oracle / webcenter_portal12.2.1.3.0 – 12.2.1.3.0
oracle / webcenter_portal12.2.1.4.0 – 12.2.1.4.0
oracle / weblogic_server12.2.1.3.0 – 12.2.1.3.0
oracle / weblogic_server12.2.1.4.0 – 12.2.1.4.0
oracle / weblogic_server14.1.1.0.0 – 14.1.1.0.0
oracle / weblogic_server12.1.3.0.0 – 12.1.3.0.0

References

Updated 19m ago · 8 sources