by Kastro
Paper/Archive/CVE-2021-44140

CVE-2021-44140

Apache Software Foundation Apache JSPWiki — Arbitrary file deletion on logout

EPSS 6%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 93.6.936 × 2018.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

Affected

ProductAffectedFixed inSource
Apache JSPWikiApache JSPWiki – 2.11.0.M8–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

refjspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-44140reflists.apache.org/thread/5qglpjdhvobppx7j550lf1sk28f6011t