CVE-2021-29425
Medium
Description
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
SeverityMedium
CVSS4.8
Exploit probability—
Product
Apache Commons Io
PublishedApr 13, 2021
First seenApr 13, 2021
Weakness typeCWE-20Improper input validation
How to fix
Update
- oracle blockchain_platform21.1.2 or later
- oracle oss_support_tools2.12.42 or later
- oracle rest_data_services21.2 or later
- commons-io:commons-io2.7 or later
- org.checkerframework.annotatedlib:commons-io2.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache commons_io | 2.2, 2.3, 2.4, 2.5, 2.6 | — |
| debian debian_linux | 9.0 | — |
| oracle access_manager | 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle agile_engineering_data_management | 6.2.1.0 | — |
| oracle agile_product_lifecycle_management | 9.3.6 | — |
| oracle application_performance_management | 13.4.1.0, 13.5.1.0 | — |
| oracle application_testing_suite | 13.3.0.1 | — |
| oracle banking_apis | 18.1, 18.2, 18.3, 19.1, 19.2, 20.1, 21.1 | — |
| oracle banking_digital_experience | 17.2, 18.1, 18.3, 19.1, 19.2, 20.1, 21.1 | — |
| oracle banking_enterprise_default_management | 2.6.2, 2.7.0, 2.7.1, 2.10.0, 2.12.0 | — |
| oracle banking_enterprise_default_managment | 2.3.0 ≤ v ≤ 2.4.0 | — |
| oracle banking_party_management | 2.7.0 | — |
| oracle banking_platform | 2.3.0 ≤ v ≤ 2.4.1, 2.6.2, 2.7.0, 2.7.1 | — |
| oracle blockchain_platform | v < 21.1.2 | 21.1.2 |
| oracle commerce_guided_search | 11.3.2 | — |
| oracle communications_application_session_controller | 3.9.0 | — |
| oracle communications_billing_and_revenue_management_elastic_charging_engine | 11.3, 12.0 | — |
| oracle communications_cloud_native_core_network_repository_function | 1.14.0 | — |
| oracle communications_cloud_native_core_policy | 1.14.0 | — |
| oracle communications_cloud_native_core_unified_data_repository | 1.4.0 | — |
| oracle communications_contacts_server | 8.0.0.6.0 | — |
| oracle communications_converged_application_server_-_service_controller | 6.2 | — |
| oracle communications_convergence | 3.0.2.2.0 | — |
| oracle communications_design_studio | 7.4.0 ≤ v ≤ 7.4.2, 7.3.5 | — |
| oracle communications_diameter_intelligence_hub | 8.0.0 ≤ v ≤ 8.1.0, 8.2.0 ≤ v ≤ 8.2.3 | — |
| oracle communications_interactive_session_recorder | 6.3, 6.4 | — |
| oracle communications_offline_mediation_controller | 12.0.0.3 | — |
| oracle communications_order_and_service_management | 7.3, 7.4 | — |
| oracle communications_policy_management | 12.5.0.0.0 | — |
| oracle communications_pricing_design_center | 12.0.0.4.0, 12.0.0.5.0 | — |
| oracle communications_service_broker | 6.2 | — |
| oracle enterprise_communications_broker | 3.3 | — |
| oracle enterprise_session_border_controller | 8.4, 9.0 | — |
| oracle financial_services_analytical_applications_infrastructure | 8.0.7 ≤ v ≤ 8.1.1 | — |
| oracle financial_services_model_management_and_governance | 8.0.8 ≤ v ≤ 8.1.1 | — |
| oracle flexcube_core_banking | 11.6.0 ≤ v ≤ 11.8.0, 5.2.0, 11.10.0 | — |
| oracle fusion_middleware_mapviewer | 12.2.1.4.0 | — |
| oracle health_sciences_data_management_workbench | 2.5.2.1, 3.0.0.0 | — |
| oracle health_sciences_information_manager | 3.0.1 ≤ v ≤ 3.0.4 | — |
| oracle healthcare_data_repository | 8.1.0 | — |
| oracle helidon | 1.4.7, 2.2.0 | — |
| oracle insurance_policy_administration | 11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1 | — |
| oracle insurance_rules_palette | 11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1 | — |
| oracle oss_support_tools | v < 2.12.42 | 2.12.42 |
| oracle primavera_unifier | 17.7 ≤ v ≤ 17.12, 18.8, 19.12, 20.12, 21.12 | — |
| oracle real_user_experience_insight | 13.4.1.0, 13.5.1.0 | — |
| oracle rest_data_services | v < 21.2, 21.3 | 21.2 |
| oracle retail_assortment_planning | 16.0.3 | — |
| oracle retail_integration_bus | 16.0.1 ≤ v ≤ 16.0.3, 13.0, 14.1.3.0, 14.1.3.2, 15.0.3.1, 19.0.0, 19.0.1 | — |
| oracle retail_merchandising_system | 16.0.3, 19.0.1 | — |
| oracle retail_order_broker | 16.0, 18.0, 19.1 | — |
| oracle retail_pricing | 19.0.1 | — |
| oracle retail_service_backbone | 16.0.1 ≤ v ≤ 16.0.3, 14.1.3.0, 14.1.3.2, 15.0.3.1, 19.0.0, 19.0.1 | — |
| oracle retail_size_profile_optimization | 16.0.3 | — |
| oracle retail_xstore_point_of_service | 17.0.4, 18.0.3, 19.0.2, 20.0.1 | — |
| oracle solaris_cluster | 4.0 | — |
| oracle utilities_testing_accelerator | 6.0.0.1.1, 6.0.0.2.2, 6.0.0.3.1 | — |
| oracle webcenter_portal | 12.2.1.3.0, 12.2.1.4.0 | — |
| oracle weblogic_server | 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | — |
| netapp active_iq_unified_manager | No range specified | — |
| commons-io:commons-ioMaven | v < 2.7 | 2.7 |
| com.cosium.vet:vetMaven | 1.0 ≤ v ≤ 3.22 | — |
| com.diamondq.common:common-thirdparty.jcasbinMaven | No range specified | — |
| com.liferay:com.liferay.sass.compiler.jsassMaven | No range specified | — |
| com.virjar:ratel-apiMaven | 1.0.0 ≤ v ≤ 1.3.6 | — |
| net.hasor:cobble-langMaven | 4.4.1 ≤ v ≤ 4.6.2 | — |
| org.apache.commons:commons-ioMaven | No range specified | — |
| org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-ioMaven | 1.4 ≤ v ≤ 1.5 | — |
| org.checkerframework.annotatedlib:commons-ioMaven | 2.6 ≤ v < 2.7 | 2.7 |
| org.smartboot.servlet:servlet-coreMaven | 0.1.9 ≤ v ≤ 0.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.