CVEDB API

Vulnerability Details CVE-2021-29425

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 46.5%

CVSS Severity

CVSS v3 Score 4.8

CVSS v2 Score 5.8

References

Products affected by CVE-2021-29425

Apache » Commons Io » Version: 2.2

cpe:2.3:a:apache:commons_io:2.2
Apache » Commons Io » Version: 2.3

cpe:2.3:a:apache:commons_io:2.3
Apache » Commons Io » Version: 2.4

cpe:2.3:a:apache:commons_io:2.4
Apache » Commons Io » Version: 2.5

cpe:2.3:a:apache:commons_io:2.5
Apache » Commons Io » Version: 2.6

cpe:2.3:a:apache:commons_io:2.6
Netapp » Active Iq Unified Manager » Version: N/A

cpe:2.3:a:netapp:active_iq_unified_manager:-
Oracle » Access Manager » Version: 11.1.2.3.0

cpe:2.3:a:oracle:access_manager:11.1.2.3.0
Oracle » Access Manager » Version: 12.2.1.3.0

cpe:2.3:a:oracle:access_manager:12.2.1.3.0
Oracle » Access Manager » Version: 12.2.1.4.0

cpe:2.3:a:oracle:access_manager:12.2.1.4.0
Oracle » Agile Engineering Data Management » Version: 6.2.1.0

cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0
Oracle » Agile Plm » Version: 9.3.6

cpe:2.3:a:oracle:agile_plm:9.3.6
Oracle » Application Performance Management » Version: 13.4.1.0

cpe:2.3:a:oracle:application_performance_management:13.4.1.0
Oracle » Application Performance Management » Version: 13.5.1.0

cpe:2.3:a:oracle:application_performance_management:13.5.1.0
Oracle » Application Testing Suite » Version: 13.3.0.1

cpe:2.3:a:oracle:application_testing_suite:13.3.0.1
Oracle » Banking Apis » Version: 18.1

cpe:2.3:a:oracle:banking_apis:18.1
Oracle » Banking Apis » Version: 18.2

cpe:2.3:a:oracle:banking_apis:18.2
Oracle » Banking Apis » Version: 18.3

cpe:2.3:a:oracle:banking_apis:18.3
Oracle » Banking Apis » Version: 19.1

cpe:2.3:a:oracle:banking_apis:19.1
Oracle » Banking Apis » Version: 19.2

cpe:2.3:a:oracle:banking_apis:19.2
Oracle » Banking Apis » Version: 20.1

cpe:2.3:a:oracle:banking_apis:20.1
Oracle » Banking Apis » Version: 21.1

cpe:2.3:a:oracle:banking_apis:21.1
Oracle » Banking Digital Experience » Version: 17.2

cpe:2.3:a:oracle:banking_digital_experience:17.2
Oracle » Banking Digital Experience » Version: 18.1

cpe:2.3:a:oracle:banking_digital_experience:18.1
Oracle » Banking Digital Experience » Version: 18.3

cpe:2.3:a:oracle:banking_digital_experience:18.3
Oracle » Banking Digital Experience » Version: 19.1

cpe:2.3:a:oracle:banking_digital_experience:19.1
Oracle » Banking Digital Experience » Version: 19.2

cpe:2.3:a:oracle:banking_digital_experience:19.2
Oracle » Banking Digital Experience » Version: 20.1

cpe:2.3:a:oracle:banking_digital_experience:20.1
Oracle » Banking Digital Experience » Version: 21.1

cpe:2.3:a:oracle:banking_digital_experience:21.1
Oracle » Banking Enterprise Default Management » Version: 2.10.0

cpe:2.3:a:oracle:banking_enterprise_default_management:2.10.0
Oracle » Banking Enterprise Default Management » Version: 2.12.0

cpe:2.3:a:oracle:banking_enterprise_default_management:2.12.0
Oracle » Banking Enterprise Default Management » Version: 2.6.2

cpe:2.3:a:oracle:banking_enterprise_default_management:2.6.2
Oracle » Banking Enterprise Default Management » Version: 2.7.0

cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.0
Oracle » Banking Enterprise Default Management » Version: 2.7.1

cpe:2.3:a:oracle:banking_enterprise_default_management:2.7.1
Oracle » Banking Enterprise Default Managment » Version: Any

cpe:2.3:a:oracle:banking_enterprise_default_managment:*
Oracle » Banking Party Management » Version: 2.7.0

cpe:2.3:a:oracle:banking_party_management:2.7.0
Oracle » Banking Platform » Version: 2.3.0

cpe:2.3:a:oracle:banking_platform:2.3.0
Oracle » Banking Platform » Version: 2.4.0

cpe:2.3:a:oracle:banking_platform:2.4.0
Oracle » Banking Platform » Version: 2.4.1

cpe:2.3:a:oracle:banking_platform:2.4.1
Oracle » Banking Platform » Version: 2.6.2

cpe:2.3:a:oracle:banking_platform:2.6.2
Oracle » Banking Platform » Version: 2.7.0

cpe:2.3:a:oracle:banking_platform:2.7.0
Oracle » Banking Platform » Version: 2.7.1

cpe:2.3:a:oracle:banking_platform:2.7.1
Oracle » Blockchain Platform » Version: N/A

cpe:2.3:a:oracle:blockchain_platform:-
Oracle » Commerce Guided Search » Version: 11.3.2

cpe:2.3:a:oracle:commerce_guided_search:11.3.2
Oracle » Communications Application Session Controller » Version: 3.9.0

cpe:2.3:a:oracle:communications_application_session_controller:3.9.0
Oracle » Communications Billing And Revenue Management Elastic Charging Engine » Version: 11.3

cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:11.3
Oracle » Communications Billing And Revenue Management Elastic Charging Engine » Version: 12.0

cpe:2.3:a:oracle:communications_billing_and_revenue_management_elastic_charging_engine:12.0
Oracle » Communications Cloud Native Core Network Repository Function » Version: 1.14.0

cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0
Oracle » Communications Cloud Native Core Policy » Version: 1.14.0

cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0
Oracle » Communications Cloud Native Core Unified Data Repository » Version: 1.4.0

cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.4.0
Oracle » Communications Contacts Server » Version: 8.0.0.6.0

cpe:2.3:a:oracle:communications_contacts_server:8.0.0.6.0
Oracle » Communications Converged Application Server - Service Controller » Version: 6.2

cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2
Oracle » Communications Convergence » Version: 3.0.2.2.0

cpe:2.3:a:oracle:communications_convergence:3.0.2.2.0
Oracle » Communications Design Studio » Version: 7.3.5

cpe:2.3:a:oracle:communications_design_studio:7.3.5
Oracle » Communications Design Studio » Version: 7.4.0

cpe:2.3:a:oracle:communications_design_studio:7.4.0
Oracle » Communications Design Studio » Version: 7.4.0.4.0

cpe:2.3:a:oracle:communications_design_studio:7.4.0.4.0
Oracle » Communications Design Studio » Version: 7.4.1

cpe:2.3:a:oracle:communications_design_studio:7.4.1
Oracle » Communications Design Studio » Version: 7.4.1.1.0

cpe:2.3:a:oracle:communications_design_studio:7.4.1.1.0
Oracle » Communications Design Studio » Version: 7.4.2

cpe:2.3:a:oracle:communications_design_studio:7.4.2
Oracle » Communications Diameter Intelligence Hub » Version: 8.0.0

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.0.0
Oracle » Communications Diameter Intelligence Hub » Version: 8.1.0

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.1.0
Oracle » Communications Diameter Intelligence Hub » Version: 8.2.0

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.0
Oracle » Communications Diameter Intelligence Hub » Version: 8.2.3

cpe:2.3:a:oracle:communications_diameter_intelligence_hub:8.2.3
Oracle » Communications Interactive Session Recorder » Version: 6.3

cpe:2.3:a:oracle:communications_interactive_session_recorder:6.3
Oracle » Communications Interactive Session Recorder » Version: 6.4

cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4
Oracle » Communications Offline Mediation Controller » Version: 12.0.0.3

cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3
Oracle » Communications Order And Service Management » Version: 7.3

cpe:2.3:a:oracle:communications_order_and_service_management:7.3
Oracle » Communications Order And Service Management » Version: 7.4

cpe:2.3:a:oracle:communications_order_and_service_management:7.4
Oracle » Communications Policy Management » Version: 12.5.0.0.0

cpe:2.3:a:oracle:communications_policy_management:12.5.0.0.0
Oracle » Communications Pricing Design Center » Version: 12.0.0.4.0

cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.4.0
Oracle » Communications Pricing Design Center » Version: 12.0.0.5.0

cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.5.0
Oracle » Communications Service Broker » Version: 6.2

cpe:2.3:a:oracle:communications_service_broker:6.2
Oracle » Enterprise Communications Broker » Version: 3.3

cpe:2.3:a:oracle:enterprise_communications_broker:3.3
Oracle » Enterprise Session Border Controller » Version: 8.4

cpe:2.3:a:oracle:enterprise_session_border_controller:8.4
Oracle » Enterprise Session Border Controller » Version: 9.0

cpe:2.3:a:oracle:enterprise_session_border_controller:9.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.7

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.7.0.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.0.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.7.1.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.1.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.7.2.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.2.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.8

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.8.0.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8.0.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.9

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.9
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.0.9.0.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.9.0.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.1.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.1.0.0.0

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.0.0.0
Oracle » Financial Services Analytical Applications Infrastructure » Version: 8.1.1

cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.1
Oracle » Financial Services Model Management And Governance » Version: 8.0.8.0.0

cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.0.8.0.0
Oracle » Financial Services Model Management And Governance » Version: 8.1.0.0.0

cpe:2.3:a:oracle:financial_services_model_management_and_governance:8.1.0.0.0
Oracle » Flexcube Core Banking » Version: 11.10.0

cpe:2.3:a:oracle:flexcube_core_banking:11.10.0
Oracle » Flexcube Core Banking » Version: 11.6.0

cpe:2.3:a:oracle:flexcube_core_banking:11.6.0
Oracle » Flexcube Core Banking » Version: 11.7.0

cpe:2.3:a:oracle:flexcube_core_banking:11.7.0
Oracle » Flexcube Core Banking » Version: 11.8.0

cpe:2.3:a:oracle:flexcube_core_banking:11.8.0
Oracle » Flexcube Core Banking » Version: 5.2.0

cpe:2.3:a:oracle:flexcube_core_banking:5.2.0
Oracle » Fusion Middleware Mapviewer » Version: 12.2.1.4.0

cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.4.0
Oracle » Health Sciences Data Management Workbench » Version: 2.5.2.1

cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1
Oracle » Health Sciences Data Management Workbench » Version: 3.0.0.0

cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0
Oracle » Health Sciences Information Manager » Version: 3.0.1

cpe:2.3:a:oracle:health_sciences_information_manager:3.0.1
Oracle » Health Sciences Information Manager » Version: 3.0.2

cpe:2.3:a:oracle:health_sciences_information_manager:3.0.2
Oracle » Health Sciences Information Manager » Version: 3.0.3

cpe:2.3:a:oracle:health_sciences_information_manager:3.0.3
Oracle » Health Sciences Information Manager » Version: 3.0.4

cpe:2.3:a:oracle:health_sciences_information_manager:3.0.4
Oracle » Healthcare Data Repository » Version: 8.1.0

cpe:2.3:a:oracle:healthcare_data_repository:8.1.0
Oracle » Helidon » Version: 1.4.7

cpe:2.3:a:oracle:helidon:1.4.7
Oracle » Helidon » Version: 2.2.0

cpe:2.3:a:oracle:helidon:2.2.0
Oracle » Insurance Policy Administration » Version: 11.0.2

cpe:2.3:a:oracle:insurance_policy_administration:11.0.2
Oracle » Insurance Policy Administration » Version: 11.1.0

cpe:2.3:a:oracle:insurance_policy_administration:11.1.0
Oracle » Insurance Policy Administration » Version: 11.2.8

cpe:2.3:a:oracle:insurance_policy_administration:11.2.8
Oracle » Insurance Policy Administration » Version: 11.3.0

cpe:2.3:a:oracle:insurance_policy_administration:11.3.0
Oracle » Insurance Policy Administration » Version: 11.3.1

cpe:2.3:a:oracle:insurance_policy_administration:11.3.1
Oracle » Insurance Rules Palette » Version: 11.0.2

cpe:2.3:a:oracle:insurance_rules_palette:11.0.2
Oracle » Insurance Rules Palette » Version: 11.1.0

cpe:2.3:a:oracle:insurance_rules_palette:11.1.0
Oracle » Insurance Rules Palette » Version: 11.2.8

cpe:2.3:a:oracle:insurance_rules_palette:11.2.8
Oracle » Insurance Rules Palette » Version: 11.3.0

cpe:2.3:a:oracle:insurance_rules_palette:11.3.0
Oracle » Insurance Rules Palette » Version: 11.3.1

cpe:2.3:a:oracle:insurance_rules_palette:11.3.1
Oracle » Oss Support Tools » Version: N/A

cpe:2.3:a:oracle:oss_support_tools:-
Oracle » Oss Support Tools » Version: 2.11.33

cpe:2.3:a:oracle:oss_support_tools:2.11.33
Oracle » Oss Support Tools » Version: 2.12.41

cpe:2.3:a:oracle:oss_support_tools:2.12.41
Oracle » Primavera Unifier » Version: 17.10

cpe:2.3:a:oracle:primavera_unifier:17.10
Oracle » Primavera Unifier » Version: 17.11

cpe:2.3:a:oracle:primavera_unifier:17.11
Oracle » Primavera Unifier » Version: 17.12

cpe:2.3:a:oracle:primavera_unifier:17.12
Oracle » Primavera Unifier » Version: 17.7

cpe:2.3:a:oracle:primavera_unifier:17.7
Oracle » Primavera Unifier » Version: 17.8

cpe:2.3:a:oracle:primavera_unifier:17.8
Oracle » Primavera Unifier » Version: 17.9

cpe:2.3:a:oracle:primavera_unifier:17.9
Oracle » Primavera Unifier » Version: 18.8

cpe:2.3:a:oracle:primavera_unifier:18.8
Oracle » Primavera Unifier » Version: 19.12

cpe:2.3:a:oracle:primavera_unifier:19.12
Oracle » Primavera Unifier » Version: 20.12

cpe:2.3:a:oracle:primavera_unifier:20.12
Oracle » Primavera Unifier » Version: 21.12

cpe:2.3:a:oracle:primavera_unifier:21.12
Oracle » Real User Experience Insight » Version: 13.4.1.0

cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0
Oracle » Real User Experience Insight » Version: 13.5.1.0

cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0
Oracle » Rest Data Services » Version: 11.2.0.4

cpe:2.3:a:oracle:rest_data_services:11.2.0.4
Oracle » Rest Data Services » Version: 12.1.0.2

cpe:2.3:a:oracle:rest_data_services:12.1.0.2
Oracle » Rest Data Services » Version: 12.2.0.1

cpe:2.3:a:oracle:rest_data_services:12.2.0.1
Oracle » Rest Data Services » Version: 18c

cpe:2.3:a:oracle:rest_data_services:18c
Oracle » Rest Data Services » Version: 19c

cpe:2.3:a:oracle:rest_data_services:19c
Oracle » Rest Data Services » Version: 20.4.3.050.1904

cpe:2.3:a:oracle:rest_data_services:20.4.3.050.1904
Oracle » Rest Data Services » Version: 21.3

cpe:2.3:a:oracle:rest_data_services:21.3
Oracle » Retail Assortment Planning » Version: 16.0.3

cpe:2.3:a:oracle:retail_assortment_planning:16.0.3
Oracle » Retail Integration Bus » Version: 13.0

cpe:2.3:a:oracle:retail_integration_bus:13.0
Oracle » Retail Integration Bus » Version: 14.1.3.0

cpe:2.3:a:oracle:retail_integration_bus:14.1.3.0
Oracle » Retail Integration Bus » Version: 14.1.3.2

cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2
Oracle » Retail Integration Bus » Version: 15.0.3.1

cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1
Oracle » Retail Integration Bus » Version: 16.0.1

cpe:2.3:a:oracle:retail_integration_bus:16.0.1
Oracle » Retail Integration Bus » Version: 16.0.2

cpe:2.3:a:oracle:retail_integration_bus:16.0.2
Oracle » Retail Integration Bus » Version: 16.0.3

cpe:2.3:a:oracle:retail_integration_bus:16.0.3
Oracle » Retail Integration Bus » Version: 19.0.0

cpe:2.3:a:oracle:retail_integration_bus:19.0.0
Oracle » Retail Integration Bus » Version: 19.0.1

cpe:2.3:a:oracle:retail_integration_bus:19.0.1
Oracle » Retail Merchandising System » Version: 16.0.3

cpe:2.3:a:oracle:retail_merchandising_system:16.0.3
Oracle » Retail Merchandising System » Version: 19.0.1

cpe:2.3:a:oracle:retail_merchandising_system:19.0.1
Oracle » Retail Order Broker » Version: 16.0

cpe:2.3:a:oracle:retail_order_broker:16.0
Oracle » Retail Order Broker » Version: 18.0

cpe:2.3:a:oracle:retail_order_broker:18.0
Oracle » Retail Order Broker » Version: 19.1

cpe:2.3:a:oracle:retail_order_broker:19.1
Oracle » Retail Pricing » Version: 19.0.1

cpe:2.3:a:oracle:retail_pricing:19.0.1
Oracle » Retail Service Backbone » Version: 14.1.3.0

cpe:2.3:a:oracle:retail_service_backbone:14.1.3.0
Oracle » Retail Service Backbone » Version: 14.1.3.2

cpe:2.3:a:oracle:retail_service_backbone:14.1.3.2
Oracle » Retail Service Backbone » Version: 15.0.3.1

cpe:2.3:a:oracle:retail_service_backbone:15.0.3.1
Oracle » Retail Service Backbone » Version: 16.0.1

cpe:2.3:a:oracle:retail_service_backbone:16.0.1
Oracle » Retail Service Backbone » Version: 16.0.3

cpe:2.3:a:oracle:retail_service_backbone:16.0.3
Oracle » Retail Service Backbone » Version: 19.0.0

cpe:2.3:a:oracle:retail_service_backbone:19.0.0
Oracle » Retail Service Backbone » Version: 19.0.1

cpe:2.3:a:oracle:retail_service_backbone:19.0.1
Oracle » Retail Size Profile Optimization » Version: 16.0.3

cpe:2.3:a:oracle:retail_size_profile_optimization:16.0.3
Oracle » Retail Xstore Point Of Service » Version: 17.0.4

cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4
Oracle » Retail Xstore Point Of Service » Version: 18.0.3

cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3
Oracle » Retail Xstore Point Of Service » Version: 19.0.2

cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2
Oracle » Retail Xstore Point Of Service » Version: 20.0.1

cpe:2.3:a:oracle:retail_xstore_point_of_service:20.0.1
Oracle » Solaris Cluster » Version: 4.0

cpe:2.3:a:oracle:solaris_cluster:4.0
Oracle » Utilities Testing Accelerator » Version: 6.0.0.1.1

cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1
Oracle » Utilities Testing Accelerator » Version: 6.0.0.2.2

cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2
Oracle » Utilities Testing Accelerator » Version: 6.0.0.3.1

cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1
Oracle » Webcenter Portal » Version: 12.2.1.3.0

cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0
Oracle » Webcenter Portal » Version: 12.2.1.4.0

cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0
Oracle » Weblogic Server » Version: 12.1.3.0.0

cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0
Oracle » Weblogic Server » Version: 12.2.1.3.0

cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0
Oracle » Weblogic Server » Version: 12.2.1.4.0

cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0
Oracle » Weblogic Server » Version: 14.1.1.0.0

cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0
Debian » Debian Linux » Version: 9.0

cpe:2.3:o:debian:debian_linux:9.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-29425

Products

Pricing

Contact Us