by Kastro
Paper/Archive/CVE-2021-34427

CVE-2021-34427

The Eclipse Foundation Eclipse BIRT — In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (cu…

EPSS 58%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.1.991 × 2019.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.

Affected

ProductAffectedFixed inSource
Eclipse BIRTunspecified – 4.8.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugs.eclipse.org/bugs/show_bug.cgi?id=538142refseclists.org/fulldisclosure/2022/Dec/30refpacketstormsecurity.com/files/170326/Eclipse-Business-Intelligence-Reporting-Tool-4.11.0-Remote-Code-Execution.html