GHSA-8gw6-w5rw-4g5c

ghsaUSosv

Incorrect Default Permissions in Apache JSPWiki

view advisory published 2021-11-29Licence: CC-BY-4.0

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-44140US	critical9.1OT elevated	6.36% (94th)	—	2021-11-24
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those f…

references

External citations — patches, advisories, analysis.

https://github.com/apache/jspwikiPACKAGE
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-44140WEB
https://lists.apache.org/thread/5qglpjdhvobppx7j550lf1sk28f6011tWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-44140ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan