CVE-2021-33800 Security Details

CVE ID

CVE-2021-33800

CWE

CWE-22

CVE Description

In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.

Published

Nov 5, 2021

CVSS Score & Severity

7.5High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

0.423%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/alibaba/druid/util/IOUtils.readByteArrayFromResource(Ljava/lang/String;)[B

JVMVulnerable params: 0

com/alibaba/druid/util/IOUtils.readFromResource(Ljava/lang/String;)Ljava/lang/String;

JVMVulnerable params: 0

com/alibaba/druid/util/Utils.readByteArrayFromResource(Ljava/lang/String;)[B

JVMVulnerable params: 0

com/alibaba/druid/util/Utils.readFromResource(Ljava/lang/String;)Ljava/lang/String;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

security.alibaba.comPROJECT