CVE-2021-20669

GROWI におけるパストラバーサル

An arbitrary path can be read and/or deleted if a remote attacker with administrative privilege sends a specially crafted request

Disclosure Date

2021/03/08

Credit

stypr (@stereotype32)

CWE

• CWE-22

Product URLs

• https://growi.org/

Reference

• https://jvn.jp/en/vu/JVNVU94889258/index.html
• https://nvd.nist.gov/vuln/detail/CVE-2021-20669
• https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/