CVE-2021-44140
Last modified
CVE-2021-44140 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.. EPSS estimates a 6.16% chance of exploitation in the next 30 days.
Description
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Jspwiki | < 2.11.0 |
References
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-44140Vendor Advisory
- https://lists.apache.org/thread/5qglpjdhvobppx7j550lf1sk28f6011tMailing List, Vendor Advisory
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-44140Vendor Advisory
- https://lists.apache.org/thread/5qglpjdhvobppx7j550lf1sk28f6011tMailing List, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-44140?
How severe is CVE-2021-44140?
How do I fix CVE-2021-44140?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-4413The Process Steps Template Designer plugin for WordPress is …4.3
- CVE-2021-44132A command injection vulnerability in the function formImport…7.8
- CVE-2021-44135pagekit all versions, as of 15-10-2021, is vulnerable to SQL…9.8
- CVE-2021-44138There is a Directory traversal vulnerability in Caucho Resin…7.5
- CVE-2021-44139Sentinel 1.8.2 is vulnerable to Server-side request forgery …7.5
- CVE-2021-4414The Abandoned Cart Lite for WooCommerce plugin for WordPress…4.3
- CVE-2021-44141All versions of Samba prior to 4.15.5 are vulnerable to a ma…4.3
- CVE-2021-44142The Samba vfs_fruit module uses extended file attributes (EA…8.8
- CVE-2021-44143A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due…9.8
- CVE-2021-44144Croatia Control Asterix 2.8.1 has a heap-based buffer over-r…9.1
- CVE-2021-44145In the TransformXML processor of Apache NiFi before 1.15.1 a…6.5
- CVE-2021-44147An XML External Entity issue in Claris FileMaker Pro and Ser…5.5
Are you affected by CVE-2021-44140?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST