Vulnerability · Published Aug 10, 2021 · Assigned by apache
CVE-2021-21501ServiceComb ServiceCenter Directory Traversal
High 7.5
In plain English
A high-severity path traversal in Apache ServiceComb from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.4%top 8.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/apache/servicecomb-service-center | 2.0.0 | GHSA-x6jv-5vfg-gm7x |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache ServiceComb | Apache ServiceComb-Service-Center 1.x – before 2.0.0 |
Weakness: CWE-22
References
- https://lists.apache.org/thread.html/r337be65e504eac52a12e89d7de40345e5d335deee9dd7288f7f59b81%40%3Cdev.servicecomb.apache.org%3E x_refsource_MISC
- [announce] 20210809 CVE-2021-21501: Apache ServiceComb: ServiceComb ServiceCenter Directory Traversal mailing-list, x_refsource_MLIST
- [oss-security] 20210810 CVE-2021-21501: Apache ServiceComb: ServiceComb ServiceCenter Directory Traversal mailing-list, x_refsource_MLIST