CVE-2021-32981

AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

• CWE-22
• CWE-22

• https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdfVendor Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05Third Party Advisory, US Government Resource
• https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2021-002.pdfVendor Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-180-05Third Party Advisory, US Government Resource

Published

Apr 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32976Five buffer overflows in the built-in web server in Moxa NPo…9.8
• CVE-2021-32977AVEVA System Platform versions 2017 through 2020 R2 P01 does…7.2
• CVE-2021-32978The programming protocol allows for a previously entered pas…7.5
• CVE-2021-32979Null pointer dereference in SuiteLink server while processin…7.5
• CVE-2021-3298Collabtive 3.1 allows XSS when an authenticated user enters …5.4
• CVE-2021-32980Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with fir…9.8
• CVE-2021-32982Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with fir…7.5
• CVE-2021-32983A Blind SQL injection vulnerability exists in the /DataHandl…9.8
• CVE-2021-32984All programming connections receive the same unlocked privil…9.8
• CVE-2021-32985AVEVA System Platform versions 2017 through 2020 R2 P01 does…7.2
• CVE-2021-32986After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs wi…9.8
• CVE-2021-32987Null pointer dereference in SuiteLink server while processin…7.5