Vulnerability Description
Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible to access any file from a filesystem, using "/../../" in the URL. This occurs because Micronaut does not restrict file access to configured paths. The vulnerability is patched in version 2.5.9. As a workaround, do not use `**` in mapping, use only `*`, which exposes only flat structure of a directory not allowing traversal. If using Linux, another workaround is to run micronaut in chroot.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Objectcomputing | Micronaut | < 2.5.9 |
Related Weaknesses (CWE)
References
- https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d1PatchThird Party Advisory
- https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-cjExploitPatchThird Party Advisory
- https://github.com/micronaut-projects/micronaut-core/commit/a0cfeb13bf1ef5d692d1PatchThird Party Advisory
- https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-cjExploitPatchThird Party Advisory
FAQ
What is CVE-2021-32769?
CVE-2021-32769 is a vulnerability with a CVSS score of 7.5 (HIGH). Micronaut is a JVM-based, full stack Java framework designed for building JVM applications. A path traversal vulnerability exists in versions prior to 2.5.9. With a basic configuration, it is possible...
How severe is CVE-2021-32769?
CVE-2021-32769 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-32769?
Check the references section above for vendor advisories and patch information. Affected products include: Objectcomputing Micronaut.