Vulnerability Description
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/MrWQ/vulnerability-paper/blob/master/bugs/JEEWMS_%E4%BB%93%E5
- https://github.com/erzhongxmu/JeeWMS/commit/0a610e8178a0a1197e9c6615b58faf67c406
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilit
- https://github.com/tzwlhack/Vulnerability/blob/main/JEEWMS%20%E6%9C%AA%E6%8E%88%
- https://www.vulncheck.com/advisories/jeewms-path-traversal-via-showordownbyurl-d
FAQ
What is CVE-2021-48015?
CVE-2021-48015 is a vulnerability with a CVSS score of 7.5 (HIGH). JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to ...
How severe is CVE-2021-48015?
CVE-2021-48015 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-48015?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.