CVE-2021-44140

Description

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

Risk Information

Base Score

9.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS Score

Exploitation Probability

5.872

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-40369,CVE-2021-44140 are fixed in Apache-jspwiki-main 2.11.0	Windows
Vulnerabilities CVE-2021-40369,CVE-2021-44140 are fixed in Apache-jspwiki-main for Linux 2.11.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234