Path traversal in Apache Commons IO - CVE-2021-29425

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU52252

Path traversal in Apache Commons IO - CVE-2021-29425

Published: April 15, 2021


Vulnerability identifier: #VU52252
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-29425
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error within the FileNameUtils.normalize method when processing directory traversal sequences, such as "//../foo", or "\..foo". A remote attacker can send a specially crafted request and verify files availability in the parent folder.


Affected software

Apache Commons IO
Oracle Utilties Application Framework
Oracle Agile PLM Framework
Oracle REST Data Services
IBM Transparent Cloud Tiering
IBM i Modernization Engine for Lifecycle Integration
Oracle Banking Platform
Oracle Utilities Network Management System
Library Support for Struts
Oracle Agile Engineering Data Management
Oracle Financial Services Analytical Applications Infrastructure
IBM Engineering Requirements Management DOORS Next
Oracle Insurance Rules Palette
webMethods BPM
Oracle Data Integrator
Oracle Communications Policy Management
Oracle Retail Service Backbone
Oracle Retail Customer Insights
Oracle Retail Order Broker
Oracle Retail Xstore Point of Service
Oracle Banking Digital Experience
Integration Designer
B2B Advanced Communications
Multi-Enterprise Integration Gateway
PowerVM NovaLink
eDiscovery Manager
Cloudera Observability with IBM
xDoctor4ECS
IBM Engineering Lifecycle Optimization - Publishing
Engineering Test Management
Storage Virtualize
IBM Engineering Systems Design Rhapsody
IBM Business Automation Workflow
Helidon
Oracle Communications Cloud Native Core Network Repository Function
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Cloud Transformation Advisor
Oracle Banking Enterprise Default Management
Oracle Health Sciences Data Management Workbench
Oracle Banking Party Management
Oracle Real-Time Decision Server
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Intelligent Operations Center
Oracle Communications Design Studio
Red Hat Decision Manager
Oracle Communications Diameter Intelligence Hub
Oracle Financial Services Model Management and Governance
Oracle Healthcare Data Repository
Oracle Enterprise Data Quality
Oracle Banking APIs
Oracle Communications EAGLE Element Management System
Autodesk Infraworks
IBM Observability with Instana
Log Analysis
Netcool Operations Insight
IBM Process Mining
IBM Cloud Pak for Data System
IBM Watson Assistant for IBM Cloud Pak for Data
QRadar User Behavior Analytics
IBM Sterling B2B Integrator
PowerProtect Data Domain
IBM Cloud Application Performance Management (APM)
Oracle Blockchain Platform
AMQ Streams
AMQ Broker
Oracle WebLogic Server
Primavera Gateway
Fuse
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Financial Services Revenue Management and Billing
Hyperion Planning
Oracle Communications Pricing Design Center
Oracle WebCenter Portal
Siebel Apps - Marketing
OSS Support Tools
Primavera Unifier
Oracle GoldenGate Application Adapters
Oracle Health Sciences Information Manager
Oracle Communications Convergence
Oracle Communications MetaSolv Solution
Oracle Communications Contacts Server
Oracle Communications Calendar Server
Oracle Communications Instant Messaging Server
Oracle Communications Offline Mediation Controller
Voice Gateway
Oracle Solaris Cluster
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
Oracle Utilities Application Framework
Oracle Utilities Testing Accelerator
Cloudera Data Platform Private Cloud Base for IBM
Oracle Insurance Policy Administration
Oracle WebCenter Sites
Oracle Fusion Middleware MapViewer
IBM App Connect for Healthcare
Oracle Insurance Insbridge Rating and Underwriting
Oracle FLEXCUBE Core Banking
IBM Qradar SIEM
IBM Cognos Controller
IBM Case Manager
Jazz Reporting Service
IBM Cognos Command Center
Oracle Communications Order and Service Management
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
RSA Authentication Manager
MySQL Enterprise Monitor
Oracle Communications BRM - Elastic Charging Engine
Splunk Enterprise
IBM Security Verify Access
Oracle Commerce Guided Search
Oracle Retail Size Profile Optimization
Oracle Retail Assortment Planning
Oracle Retail Merchandising System
Oracle Retail Pricing
Oracle Service Bus
Oracle Retail Integration Bus
apache-commons-io
libcommons-io-java (Ubuntu package)
apache-commons-io-help
Operational Decision Manager
IBM Cognos Analytics

How to mitigate CVE-2021-29425

Install update from vendor's website.

Apache Commons IO - update to 2.7
IBM i Modernization Engine for Lifecycle Integration - update to 1.0.1
AMQ Streams - update to 1.8.0
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 2.2.1-patch-4, 4.0.2
IBM Cloud Transformation Advisor - update to 3.1.0
OSS Support Tools - update to 2.12.42
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.0.6
IBM Intelligent Operations Center - update to 5.2.4
Oracle FLEXCUBE Core Banking - update to 11.8.0
Cloudera Data Platform Private Cloud Base for IBM - addressed in versions 7.1.7 SP3, 7.1.9 SP1
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 10, 7.4.3 Fix Pack 3, 7.4.3 Fix Pack 4
AMQ Broker - update to 7.9.0
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.12.1
Red Hat Decision Manager - update to 7.12.1
MySQL Enterprise Monitor - update to 8.0.27
Splunk Enterprise - addressed in versions 8.2.12, 9.0.6, 9.0.9, 9.1.1, 9.1.4, 9.2.1
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
IBM Cognos Controller - update to 11.0.1.0.3
webMethods BPM - update to 11.1 Fix 1
Primavera Gateway - addressed in versions 18.8.13, 19.12.12
Autodesk Infraworks - addressed in versions 2019.3 Hotfix 5, 2020.2 Hotfix 4, 2021.2 Hotfix 4, 2022.0 Hotfix 3, 2022.1 Hotfix 2
B2B Advanced Communications - update to 1.0.0.8
Multi-Enterprise Integration Gateway - update to 1.0.0.8
Voice Gateway - addressed in versions 1.0.8.2, 1.0.8.6
IBM Observability with Instana - update to 1.0.292
Log Analysis - update to 1.3.7.2 IF004
Netcool Operations Insight - update to 1.6.6
IBM Process Mining - update to 1.12.0.4
PowerVM NovaLink - addressed in versions 2.0.1-230201, 2.0.3.1.1-230127, 2.1.0-230209
IBM Cloud Pak for Data System - update to 2.0.2.1
eDiscovery Manager - update to 2.2.2.3.7
apache-commons-io - addressed in versions 2.4-9.3.1, 2.6-3.3.1
libcommons-io-java (Ubuntu package) - addressed in versions 2.6-2ubuntu0.18.04.1, 2.6-2ubuntu0.20.04.1
apache-commons-io-help - update to 2.6-7
apache-commons-io - update to 2.6-7
Cloudera Observability with IBM - update to 3.6.2
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.0.0
QRadar User Behavior Analytics - update to 4.1.9
xDoctor4ECS - update to 4.8-84.0
IBM Case Manager - update to 5.3.3-IF011
IBM Sterling B2B Integrator - addressed in versions 6.0.3.7, 6.1.0.5, 6.1.1.2, 6.1.2.0
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.1.23, 7.0.2.25
Jazz Reporting Service - update to 7.0.2 iFix026
Engineering Test Management - addressed in versions 7.0.2.0.21, 7.0.3.0.22
PowerProtect Data Domain - addressed in versions 7.7.4, 7.10.0.0
Fuse - update to 7.10.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Storage Virtualize - addressed in versions 8.6.3.0, 8.7.0.0
RSA Authentication Manager - update to 8.7 Patch 2
Operational Decision Manager - addressed in versions 8.10.5.2 Interim fix 1, 8.11.0.1 Interim fix 30, 8.11.1 Interim fix 24, 8.12.0.1 Interim fix 5
IBM Engineering Systems Design Rhapsody - addressed in versions 9.0.1.0.6, 9.0.2.0.2, 10.0.0.1
IBM Cognos Command Center - update to 10.2.4 Fix Pack 1 IF17
IBM Cognos Analytics - addressed in versions 11.1.7.6, 11.2.3
Oracle Blockchain Platform - update to 21.1.2
Oracle REST Data Services - update to 21.2.0

External References

Related Security Bulletins