Live › vulnerability › CVE-2021-48015
Go to dashboardJeeWMS before commit 0a610e8 has a path traversal flaw in the dbPath parameter of a GET endpoint, and it skips the login check. A remote attacker can send ../ sequences to read any file the application can access, such as win.ini.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
This page as .md · .json · in your agent: get_signal("CVE-2021-48015")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.