CVE-2021-34427: eclipse business intelligence and reporting…

csirt@kutim:~/threat-intel/cve/CVE-2021-34427

CVSS 9.8 · Critical EPSS 58,0%

Kerentanan Improper Input Validation pada eclipse business intelligence and reporting tools. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.

Rincian

Terbit di NVD: 25 Juni 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
CWE-434: Unrestricted Upload of File with Dangerous Type
EPSS (30 hari): 58,0% peluang dieksploitasi; lebih tinggi dari 99,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
eclipse	business intelligence and reporting tools	Semua versi hingga 4.8.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142 exploit · issue tracking · patch · advisory vendor
http://packetstormsecurity.com/files/170326/Eclipse-Business-Intelligence-Reporting-Tool-4.11.0-Remote-Code-Ex... exploit · advisory pihak ketiga
http://seclists.org/fulldisclosure/2022/Dec/30 exploit · mailing list · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.