CVE-2021-42052

IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and the R query parameter.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

1.06% chance of exploitation in the next 30 days, 62th percentile

Published

2022-08-16

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://nxnjz.net/2022/08/cve-2021-42052-full-disclosure/

References

• CVE Record
• NVD entry

Related

• CVE-2021-42051
• CVE-2021-42053
• CVE-2021-42050
• CVE-2021-42056
• CVE-2021-4204
• CVE-2021-42057