CVE-2021-44140: Incorrect Default Permissions in Apache JSPWiki
Summary
CVE-2021-44140: Incorrect Default Permissions in Apache JSPWiki. Affects org.apache.jspwiki:jspwiki-main versions < 2.11.0. Fixed in 2.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache JSPWiki is an open-source wiki engine written in Java. It allows users to create and manage content collaboratively. JSPWiki versions up to 2.11.0.M8 are affected by a vulnerability that allows remote attackers to delete arbitrary files on a system hosting a JSPWiki instance. This vulnerability occurs due to incorrect default permissions. The user running the JSPWiki instance must have access to the files for them to be deleted. It is recommended to upgrade to Apache JSPWiki version 2.11.0 or later to mitigate this issue.
Vulnerability Detail
The vulnerability (CVE-2021-44140) in Apache JSPWiki allows remote attackers to delete arbitrary files on a system hosting a JSPWiki instance. This can be achieved by carefully crafting an HTTP request on logout. However, the attacker must have access to the files they intend to delete. The vulnerability arises from incorrect default permissions. The impact of this vulnerability can be severe, as an attacker can delete important files, potentially leading to data loss or disruption of services.
How To Fix
Minimum fixed version
2.11.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Apache JSPWiki (CVE-2021-44140) allows remote attackers to delete arbitrary files on a system hosting a JSPWiki instance. It is crucial to upgrade to Apache JSPWiki version 2.11.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.jspwiki:jspwiki-main →
FAQ
Apache JSPWiki is an open-source wiki engine written in Java. It allows users to collaboratively create and manage content.
The vulnerability allows remote attackers to delete arbitrary files on a system hosting a JSPWiki instance. This can lead to data loss or disruption of services.
To mitigate this vulnerability, it is recommended to upgrade to Apache JSPWiki version 2.11.0 or later.
No, upgrading to the latest version of Apache JSPWiki is the recommended solution.
You can find more information about this vulnerability in the CVE-2021-44140 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.jspwiki:jspwiki-main.
