NexaPulse
Subscribe
4.8mediumMedium

CVE-2021-29425

Apache Commons Io

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Exploitation status

  • Published references include exploit or proof-of-concept material. There is no confirmation it is being used in real attacks.
  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is reachable over a network, without needing local access.
  • For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
  • To exploit it, no account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
4.8 (v3.1)
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-20
Assigned by
security@apache.org

Dates

Published
2021-04-13
Last modified
2026-08-25
Sources
NVD

Affected products

  • Apache Commons Io2.2, 2.3, 2.4, 2.5, 2.6
  • Debian Debian Linux9.0
  • Oracle Access Manager11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0
  • Oracle Agile Engineering Data Management6.2.1.0
  • Oracle Agile Product Lifecycle Management9.3.6
  • Oracle Application Performance Management13.4.1.0, 13.5.1.0
  • Oracle Application Testing Suite13.3.0.1
  • Oracle Banking Apis18.1, 18.2, 18.3, 19.1, 19.2, 20.1, 21.1
  • Oracle Banking Digital Experience17.2, 18.1, 18.3, 19.1, 19.2, 20.1, 21.1
  • Oracle Banking Enterprise Default Management2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0
  • Oracle Banking Enterprise Default Managment2.3.0 - 2.4.0
  • Oracle Banking Party Management2.7.0

As listed in the NVD configuration data. Not a statement about your estate.

References