CVE Feed

    Dashboard / CVE / CVE-2021-22118

    CVE-2021-22118

    In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

    Published:May 25, 2021
    Last Modified:Nov 21, 2024
    EPS:May 27, 2021
    EPSS Score:0.00253
    CVSS Score:7.8

    Affected Products

    Vendor
    Netapp
    Product
    Hci
    Vendor
    Netapp
    Product
    Management Services For Element Software
    Vendor
    Oracle
    Product
    Commerce Guided Search
    Vendor
    Oracle
    Product
    Communications Brm - Elastic Charging Engine
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Binding Support Function
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Policy
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Security Edge Protection Proxy
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Service Communication Proxy
    Vendor
    Oracle
    Product
    Communications Cloud Native Core Unified Data Repository
    Vendor
    Oracle
    Product
    Communications Diameter Intelligence Hub
    Vendor
    Oracle
    Product
    Communications Element Manager
    Vendor
    Oracle
    Product
    Communications Interactive Session Recorder
    Vendor
    Oracle
    Product
    Communications Network Integrity
    Vendor
    Oracle
    Product
    Communications Session Report Manager
    Vendor
    Oracle
    Product
    Communications Session Route Manager
    Vendor
    Oracle
    Product
    Communications Unified Inventory Management
    Vendor
    Oracle
    Product
    Documaker
    Vendor
    Oracle
    Product
    Enterprise Data Quality
    Vendor
    Oracle
    Product
    Financial Services Analytical Applications Infrastructure
    Vendor
    Oracle
    Product
    Healthcare Data Repository
    Vendor
    Oracle
    Product
    Insurance Policy Administration
    Vendor
    Oracle
    Product
    Insurance Rules Palette
    Vendor
    Oracle
    Product
    Mysql Enterprise Monitor
    Vendor
    Oracle
    Product
    Retail Assortment Planning
    Vendor
    Oracle
    Product
    Retail Customer Management And Segmentation Foundation
    Vendor
    Oracle
    Product
    Retail Financial Integration
    Vendor
    Oracle
    Product
    Retail Integration Bus
    Vendor
    Oracle
    Product
    Retail Merchandising System
    Vendor
    Oracle
    Product
    Retail Order Broker
    Vendor
    Oracle
    Product
    Retail Predictive Application Server
    Vendor
    Oracle
    Product
    Utilities Testing Accelerator
    Vendor
    Redhat
    Product
    Integration
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Vmware
    Product
    Spring Framework

    Exploits

    No exploit reference

    Related CVEs

    CVE-2023-36054 (CVSS 6.5) — lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitia…
    CVE-2023-32250 (CVSS 9) — A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exist…
    CVE-2022-45061 (CVSS 7.5) — An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when pr…
    CVE-2022-37434 (CVSS 9.8) — zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large g…
    CVE-2021-42340 (CVSS 7.5) — The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 …
    CVE-2021-3737 (CVSS 7.5) — A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a …
    CVE-2021-28169 (CVSS 5.3) — For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet w…
    CVE-2022-0391 (CVSS 7.5) — A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resou…
    CVE-2020-27223 (CVSS 5.2) — In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a requ…
    CVE-2020-8582 (CVSS 6.5) — Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability whi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High