CVE-2021-32769

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada objectcomputing micronaut. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut does not restrict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in mapping, use only `*`, which exposes only flat structure of a directory not allowing traversal. If using Linux, another workaround is to run micronaut in chroot.

Rincian

Terbit di NVD

16 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d16d4a3b91b34b7456bb11 patch · advisory pihak ketiga
• https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-cjx7-399x-p2rj exploit · patch · advisory pihak ketiga