CVE-2021-44140 Arbitrary file deletion on logout

2021-11-2411:15:14

apache

www.cve.org

arbitrary file deletion

remote attackers

jspwiki

apache

cve-2021-44140

AI Score

9.4

Confidence

High

EPSS

0.005

Percentile

75.7%

JSON

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

CNA Affected

[
  {
    "product": "Apache JSPWiki",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.11.0.M8",
        "status": "affected",
        "version": "Apache JSPWiki",
        "versionType": "custom"
      }
    ]
  }
]