cbcvebase.
CVE-2021-29425
published 2021-04-13

CVE-2021-29425: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result…

PriorityP434medium4.8CVSS 3.1
AVNACHPRNUINSUCLILAN
EPSS
10.61%
95.3th percentile
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Affected

139 ranges· showing 25
VendorProductVersion rangeFixed in
apachecommons_io
apachecommons_io
apachecommons_io
apachecommons_io
apachecommons_io
apache_software_foundationapache_commons_io
apache_software_foundationapache_commons_io
apache_software_foundationapache_commons_io
apache_software_foundationapache_commons_io
apache_software_foundationapache_commons_io
debiancommons-io< commons-io 2.8.0-1 (bookworm)commons-io 2.8.0-1 (bookworm)
debiandebian_linux
oracleaccess_manager
oracleaccess_manager
oracleaccess_manager
oracleagile_engineering_data_management
oracleagile_plm
oracleapplication_performance_management
oracleapplication_performance_management
oracleapplication_testing_suite
oraclebanking_apis
oraclebanking_apis
oraclebanking_apis
oraclebanking_apis
oraclebanking_apis

CVSS provenance

nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv4.8MEDIUM
vendor_oracle5.3MEDIUM
vendor_debian4.8MEDIUM
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.