CVE-2021-20517 — Path Traversal in IBM Websphere Application Server ND

CWE-22 — Path Traversal3 documents3 sources
Severity
8.8HIGHNVD
EPSS
1.1%
top 21.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Websphere Application Server ND
Timeline
PublishedJun 7
Latest updateMay 24

Description

IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to read and delete arbitrary files on the system. IBM X-Force ID: 198435.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDibm/websphere_application8.5.0.0 — 8.5.5.20+1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-fppj-frvc-63q2: IBM WebSphere Application Server Network Deployment 8↗2022-05-24
▶
CVEList
CVE-2021-20517: IBM WebSphere Application Server Network Deployment 8↗2021-06-07
▶
CVE-2021-20517 — Path Traversal in IBM | cvebase