CVE-2021-20668

GROWI のパストラバーサル

An arbitrary path can be read if a remote attacker with administrative privilege accesses the affected product via a specially crafted URL

Disclosure Date

2021/03/08

Credit

stypr (@stereotype32)

CWE

• CWE-22

Product URLs

• https://growi.org/

Reference

• http://jvn.jp/en/vu/JVNVU94889258/index.html
• https://nvd.nist.gov/vuln/detail/CVE-2021-20668
• https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/