Back to the CVE list
CVE-2021-29425Suited to automated attack · CISA

Possible limited path traversal vulnerabily in Apache Commons IO

CVSS score

6.5

EPSS probability

%10.5

Risk score

0.7

Published

5 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2021-29425 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2021-29425 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1Apache Software FoundationApache Commons IO View
2apachecommons io View
3apachecommons io View
4apachecommons io View
5apachecommons io View
6apachecommons io View
7debiandebian linux View
8oracleaccess manager View
9oracleaccess manager View
10oracleaccess manager View
11oracleagile engineering data management View
12oracleagile product lifecycle management View
13oracleapplication performance management View
14oracleapplication performance management View
15oracleapplication testing suite View
16oraclebanking apis View
17oraclebanking apis View
18oraclebanking apis View
19oraclebanking apis View
20oraclebanking apis View
21oraclebanking apis View
22oraclebanking apis View
23oraclebanking digital experience View
24oraclebanking digital experience View
25oraclebanking digital experience View
26oraclebanking digital experience View
27oraclebanking digital experience View
28oraclebanking digital experience View
29oraclebanking digital experience View
30oraclebanking enterprise default management View
31oraclebanking enterprise default management View
32oraclebanking enterprise default management View
33oraclebanking enterprise default management View
34oraclebanking enterprise default management View
35oraclebanking enterprise default managment View
36oraclebanking party management View
37oraclebanking platform View
38oraclebanking platform View
39oraclebanking platform View
40oraclebanking platform View
41oracleblockchain platform View
42oraclecommerce guided search View
43oraclecommunications application session controller View
44oraclecommunications billing and revenue management elastic charging engine View
45oraclecommunications billing and revenue management elastic charging engine View
46oraclecommunications cloud native core network repository function View
47oraclecommunications cloud native core policy View
48oraclecommunications cloud native core unified data repository View
49oraclecommunications contacts server View
50oraclecommunications converged application server - service controller View
51oraclecommunications convergence View
52oraclecommunications design studio View
53oraclecommunications design studio View
54oraclecommunications diameter intelligence hub View
55oraclecommunications diameter intelligence hub View
56oraclecommunications interactive session recorder View
57oraclecommunications interactive session recorder View
58oraclecommunications offline mediation controller View
59oraclecommunications order and service management View
60oraclecommunications order and service management View
61oraclecommunications policy management View
62oraclecommunications pricing design center View
63oraclecommunications pricing design center View
64oraclecommunications service broker View
65oracleenterprise communications broker View
66oracleenterprise session border controller View
67oracleenterprise session border controller View
68oraclefinancial services analytical applications infrastructure View
69oraclefinancial services model management and governance View
70oracleflexcube core banking View
71oracleflexcube core banking View
72oracleflexcube core banking View
73oraclefusion middleware mapviewer View
74oraclehealth sciences data management workbench View
75oraclehealth sciences data management workbench View
76oraclehealth sciences information manager View
77oraclehealthcare data repository View
78oraclehelidon View
79oraclehelidon View
80oracleinsurance policy administration View
81oracleinsurance policy administration View
82oracleinsurance policy administration View
83oracleinsurance policy administration View
84oracleinsurance policy administration View
85oracleinsurance rules palette View
86oracleinsurance rules palette View
87oracleinsurance rules palette View
88oracleinsurance rules palette View
89oracleinsurance rules palette View
90oracleoss support tools View
91oracleprimavera unifier View
92oracleprimavera unifier View
93oracleprimavera unifier View
94oracleprimavera unifier View
95oracleprimavera unifier View
96oraclereal user experience insight View
97oraclereal user experience insight View
98oraclerest data services View
99oraclerest data services View
100oracleretail assortment planning View
101oracleretail integration bus View
102oracleretail integration bus View
103oracleretail integration bus View
104oracleretail integration bus View
105oracleretail integration bus View
106oracleretail integration bus View
107oracleretail integration bus View
108oracleretail merchandising system View
109oracleretail merchandising system View
110oracleretail order broker View
111oracleretail order broker View
112oracleretail order broker View
113oracleretail pricing View
114oracleretail service backbone View
115oracleretail service backbone View
116oracleretail service backbone View
117oracleretail service backbone View
118oracleretail service backbone View
119oracleretail service backbone View
120oracleretail size profile optimization View
121oracleretail xstore point of service View
122oracleretail xstore point of service View
123oracleretail xstore point of service View
124oracleretail xstore point of service View
125oraclesolaris cluster View
126oracleutilities testing accelerator View
127oracleutilities testing accelerator View
128oracleutilities testing accelerator View
129oraclewebcenter portal View
130oraclewebcenter portal View
131oracleweblogic server View
132oracleweblogic server View
133oracleweblogic server View
134oracleweblogic server View
135netappactive iq unified manager View
Total affected vendors: 5|Products: 135

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
6.5CVSS V31MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NNVD
6.5CVSS V3_1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE ADP
5.8CVSS V2—AV:N/AC:M/Au:N/C:P/I:P/A:NNVD
4.8CVSS V31MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

3 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-29425 is associated with the following CWEs:

CWE-20: Improper Input ValidationCWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2021-29425 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekmiyor

Official Sources and Advisories

https://issues.apache.org/jira/browse/IO-556vendor-advisoryhttps://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3Evendor-advisory[commons-dev] 20210414 Re: [all] OSS Fuzzvendor-advisory[commons-dev] 20210415 Re: [all] OSS Fuzzvendor-advisory[pulsar-commits] 20210420 [GitHub] [pulsar] lhotari opened a new pull request #10287: [Security] Upgrade commons-io to address CVE-2021-29425vendor-advisory[pulsar-commits] 20210420 [GitHub] [pulsar] merlimat merged pull request #10287: [Security] Upgrade commons-io to address CVE-2021-29425vendor-advisory[creadur-dev] 20210427 [jira] [Closed] (RAT-281) Update commons-io to fix CVE-2021-29425 Moderate severityvendor-advisory[creadur-dev] 20210427 [jira] [Created] (RAT-281) Update commons-io to fix CVE-2021-29425 Moderate severityvendor-advisory[creadur-dev] 20210427 [jira] [Commented] (RAT-281) Update commons-io to fix CVE-2021-29425 Moderate severityvendor-advisory[creadur-dev] 20210427 [jira] [Updated] (RAT-281) Update commons-io to fix CVE-2021-29425 Moderate severityvendor-advisory

CVSS Vector Radar Chart

6.5 / 10
Attack VectorNetworkComplexityLowPrivilegesNoneUser Interact.NoneConfidentialityLowIntegrityNoneAvailabilityNone

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone required
User InteractionNone required
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)None
Availability (Erişilebilirlik)None

Yama doğrulandı

3 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

AS
Apache Software Foundation logo
Apache Software Foundation
A
apache logo
apache
D
debian logo
debian
O
oracle logo
oracle
N
netapp logo
netapp

Weakness Type (CWE & CAPEC)

CWE-20 CWE-22

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2021-29425"