Vulnerability · Published Nov 19, 2021 · Assigned by vmware
CVE-2021-22028
Critical 9.1
In plain English
A critical-severity path traversal in gpfdist (Greenplum). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)2.4%top 15.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In versions of Greenplum database prior to 5.28.6 and 6.14.0, greenplum database contains a file path traversal vulnerability leading to information disclosure from the file system. A malicious user can read/write information from the file system using this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | gpfdist (Greenplum) | gpfdist (Greenplum) versions 6.x.0 prior to 6.14.0 and 5.28.x prior to 5.28.6 |
Weakness: CWE-22