CVE-2021-29425
Published on: 04/13/2021 12:00:00 AM UTC
Last Modified on: 10/27/2022 01:19:00 PM UTC
Certain versions of Commons Io from Apache contain the following vulnerability:
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
- CVE-2021-29425 has been assigned by
[email protected] to track the vulnerability - currently rated as MEDIUM severity. - Affected Vendor/Software: Apache Software Foundation - Apache Commons IO version = 2.2
- Affected Vendor/Software: Apache Software Foundation - Apache Commons IO version = 2.3
- Affected Vendor/Software: Apache Software Foundation - Apache Commons IO version = 2.4
- Affected Vendor/Software: Apache Software Foundation - Apache Commons IO version = 2.5
- Affected Vendor/Software: Apache Software Foundation - Apache Commons IO version = 2.6
Vulnerability Patch/Work Around
- Neither the method in question (FileNameUtils.normalize) nor any methods, that invoke it, do actually access any files. There's only a string returned, from which a path can be constructed. In other words, a possible workaround would be not passing any unsafe input to FileNameUtils.normalize.
- Upgrade to Apache Commons IO 2.7, or later, where the same method returns the value null, as an indication of "invalid input".
CVSS3 Score: 4.8 - MEDIUM
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | HIGH | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | LOW | LOW | NONE |
CVSS2 Score: 5.8 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | MEDIUM | NONE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | PARTIAL | NONE |
CVE References
MLIST [creadur-dev] 20210427 [jira] [Commented] (RAT-281) Update commons-io to fix CVE-2021-29425 Moderate severity
MISC www.oracle.com/security-alerts/cpuapr2022.html
CONFIRM security.netapp.com/advisory/ntap-20220210-0004/
MLIST [debian-lts-announce] 20210812 [SECURITY] [DLA 2741-1] commons-io security update
MISC issues.apache.org/jira/browse/IO-556Related QID Numbers
- 150500 Oracle WebLogic Server Multiple Vulnerabilities (JAN2022)
- 150588 Oracle WebLogic Server Multiple Vulnerabilities (CPUOCT2022)
- 174935 SUSE Enterprise Linux Security Update for apache-commons-io (SUSE-SU-2021:1282-1)
- 174945 SUSE Enterprise Linux Security Update for apache-commons-io (SUSE-SU-2021:1315-1)
- 178758 Debian Security Update for commons-io (DLA 2741-1)
- 179750 Debian Security Update for commons-io (CVE-2021-29425)
- 198519 Ubuntu Security Notification for Apache Commons IO Vulnerability (USN-5095-1)
- 20276 Oracle Database 19c Critical OJVM Patch Update - October 2021
- 20290 Oracle Database 12.2.0.1 Critical OJVM Patch Update - October 2021
- 239608 Red Hat Update for Red Hat JBoss Enterprise Application Platform 7.3.9 (RHSA-2021:3468)
- 239609 Red Hat Update for Red Hat JBoss Enterprise Application Platform 7.3.9 (RHSA-2021:3467)
- 239610 Red Hat Update for Red Hat JBoss Enterprise Application Platform 7.3.9 (RHSA-2021:3466)
- 239652 Red Hat Update for Red Hat JBoss Enterprise Application Platform 7.4.1 (RHSA-2021:3658)
- 239653 Red Hat Update for Red Hat JBoss Enterprise Application Platform 7.4.1 (RHSA-2021:3656)
- 375970 Oracle PeopleSoft Enterprise PeopleTools Product Multiple Vulnerabilities (CPUOCT2021)
- 750250 OpenSUSE Security Update for apache-commons-io (openSUSE-SU-2021:0605-1)
- 87467 Oracle WebLogic Server Multiple Vulnerabilities (CPUOCT2021)
- 87478 Oracle WebLogic Server Multiple Vulnerabilities (CPUJAN2022)
- 980351 Java (maven) Security Update for commons-io:commons-io (GHSA-gwrp-pvrq-jmwv)
Exploit/POC from Github
PoC for exploiting CVE-2021-29425 : In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize…
Known Affected Configurations (CPE V2.3)
- cpe:2.3:a:apache:commons_io:*:*:*:*:*:*:*:*:
- cpe:2.3:a:apache:commons_io:2.2:-:*:*:*:*:*:*:
- cpe:2.3:a:apache:commons_io:2.3:-:*:*:*:*:*:*:
- cpe:2.3:a:apache:commons_io:2.4:-:*:*:*:*:*:*:
- cpe:2.3:a:apache:commons_io:2.5:-:*:*:*:*:*:*:
- cpe:2.3:a:apache:commons_io:2.6:-:*:*:*:*:*:*:
- cpe:2.3:a:apache:pluto:*:*:*:*:*:*:*:*:
- cpe:2.3:a:apache:whisker:*:*:*:*:*:*:*:*:
- cpe:2.3:a:apache:whisker:0.2:*:*:*:*:*:*:*:
- cpe:2.3:a:apache:zookeeper:3.8.0:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*:
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*:
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*:
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*:
- cpe:2.3:a:oracle:access_manager:11.1.2.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:access_manager:12.2.1.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:application_performance_management:13.4.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:application_performance_management:13.5.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_apis:18.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_apis:18.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_apis:18.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_apis:19.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_apis:19.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_apis:20.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_apis:21.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_digital_experience:17.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_digital_experience:21.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_managment:2.10.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_managment:2.12.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_managment:2.6.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_managment:2.7.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_managment:2.7.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_enterprise_default_managment:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_party_management:2.7.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_platform:2.7.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_application_session_controller:3.9.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_calendar_server:8.0.0.6.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_contacts_server:8.0.0.6.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_design_studio:7.3.5:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_design_studio:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*:
- cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_metasolv_solution:6.3.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_order_and_service_management:7.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_order_and_service_management:7.4:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_policy_management:12.5.0.0.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.5.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:communications_service_broker:6.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:documaker:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:enterprise_communications_broker:3.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:enterprise_session_border_controller:9.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:financial_services_model_management_and_governance:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:flexcube_core_banking:11.10.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:flexcube_core_banking:5.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:flexcube_core_banking:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:goldengate_application_adapters:19.1.0.0.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:health_sciences_information_manager:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:helidon:1.4.7:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:helidon:2.2.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:hyperion_financial_management:11.1.2.4:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:hyperion_financial_management:11.2.6.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration:11.0.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration:11.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration:11.2.8:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration:11.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_policy_administration:11.3.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_rules_palette:11.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_rules_palette:11.2.8:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_rules_palette:11.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:insurance_rules_palette:11.3.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:real-time_decision_server:3.2.0.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*:
- cpe:2.3:a:oracle:rest_data_services:21.3:*:*:*:-:*:*:*:
- cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_integration_bus:13.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_integration_bus:14.1.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_integration_bus:19.0.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_integration_bus:19.0.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_integration_bus:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_merchandising_system:16.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_order_broker:18.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_order_broker:19.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_pricing:19.0.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_service_backbone:14.1.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_service_backbone:19.0.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_service_backbone:19.0.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_service_backbone:*:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_size_profile_optimization:16.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:solaris_cluster:4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*:
- cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @oss_security |
CVE-2021-29425 (Possible limited path traversal in Apache Commons IO 2.2 to 2.6): Posted by Jochen Wiedmann on Apr… twitter.com/i/web/status/1… | 2021-04-12 19:15:05 |
| @CVEreport |
CVE-2021-29425 : In #Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an imprope… twitter.com/i/web/status/1… | 2021-04-13 06:54:52 |
| @ApacheZooKeeper |
#zookeeper: "[jira] [Created] (ZOOKEEPER-4343) OWASP Dependency-Check fails with CVE-2021-29425, commons-io-2.6" ift.tt/3js81wf | 2021-08-05 08:58:13 |
| @AlirezaGhahrood |
exploit CVE-2021-29425: Apache Commons IO <2.7 - "Limited" Path Traversal (PoC) lnkd.in/dBDUhUp8 Black Hat… twitter.com/i/web/status/1… | 2021-08-08 13:59:01 |
| @Securityblog |
GitHub - AlAIAL90/CVE-2021-29425: PoC for exploiting CVE-2021-29425 : In Apache Commons IO before 2.7, When invokin… twitter.com/i/web/status/1… | 2021-08-09 07:20:30 |
| @management_sun |
IT Risk:Red Hat.AMQ Streamsに多くの脆弱性 CVE-2021-34428 CVE-2021-29425 CVE-2021-28169 CVE-2021-28168 CVE-2021-28165 CVE-2… twitter.com/i/web/status/1… | 2021-08-27 00:23:49 |
| @management_sun |
IT Risk:RMany vulnerabilities in ed Hat.AMQ Streams CVE-2021-34428 CVE-2021-29425 CVE-2021-28169 CVE-2021-28168 CVE… twitter.com/i/web/status/1… | 2021-08-27 00:23:56 |
| @management_sun |
IT Risk:Red Hat.JBoss Enterprise Application Platformに複数の脆弱性 CVE-2021-29425 CVE-2021-28170 CVE-2021-21409 CVE-2021-… twitter.com/i/web/status/1… | 2021-09-24 00:50:51 |
| @management_sun |
IT Risk:Red Hat.Multiple vulnerabilities in JBoss Enterprise Application Platform CVE-2021-29425 CVE-2021-28170 CVE… twitter.com/i/web/status/1… | 2021-09-24 00:51:28 |
 /r/netcve |
CVE-2021-29425 | 2021-04-13 07:11:18 |