CVE-2021-47755
Last modified
CVE-2021-47755 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet endpoint. Attackers can exploit the vulnerability by manipulating the 'fileName' parameter to download sensitive files from the server's filesystem.. EPSS estimates a 0.75% chance of exploitation in the next 30 days.
Description
Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized input in the FileServlet endpoint. Attackers can exploit the vulnerability by manipulating the 'fileName' parameter to download sensitive files from the server's filesystem.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Softlinkint | Oliver V5 Library | < 8.00.008.053 |
References
- https://www.exploit-db.com/exploits/50599Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/50599Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-47755?
How severe is CVE-2021-47755?
How do I fix CVE-2021-47755?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-47749YouPHPTube <= 7.8 contains a local file inclusion vulnerabil…8.7
- CVE-2021-47750YouPHPTube <= 7.8 contains a cross-site scripting vulnerabil…6.1
- CVE-2021-47751CuteEditor for PHP (now referred to as Rich Text Editor) 6.6…7.5
- CVE-2021-47752AWebServer GhostBuilding 18 contains a denial of service vul…8.7
- CVE-2021-47753phpKF CMS 3.00 Beta y6 contains an unauthenticated file uplo…9.8
- CVE-2021-47754Arunna 1.0.0 contains a cross-site request forgery vulnerabi…6.9
- CVE-2021-47756Laravel Valet versions 1.1.4 to 2.0.3 contain a local privil…8.4
- CVE-2021-47757Chikitsa Patient Management System 2.0.2 contains an authent…8.8
- CVE-2021-47758Chikitsa Patient Management System 2.0.2 contains an authent…8.8
- CVE-2021-47759MTPutty 1.0.1.21 contains a sensitive information disclosure…6.8
- CVE-2021-47760Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2021-47761MilleGPG5 5.7.2 contains a local privilege escalation vulner…8.5
Are you affected by CVE-2021-47755?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST