CVE-2021-20876 - OpenCVE

Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on the published site's server via unspecified vectors.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Groupsession	Groupsession

Configuration 1 [-]

OR	cpe:2.3:a:groupsession:groupsession:::::cloud:::*
	cpe:2.3:a:groupsession:groupsession:::::free:::*
	cpe:2.3:a:groupsession:groupsession:::::zion:::*

No data.

References

Link	Providers
https://groupsession.jp/info/info-news/security20211220
https://jvn.jp/en/jp/JVN79798166/index.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2021-12-24T06:30:32

Updated: 2024-08-03T17:53:23.073Z

Reserved: 2020-12-17T00:00:00

Link: CVE-2021-20876

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-12-24T07:15:06.790

Modified: 2022-01-10T13:21:36.353

Link: CVE-2021-20876

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "GroupSession Free edition, GroupSession byCloud, GroupSession ZION", "vendor": "Japan Total System Co.,Ltd.", "versions": [{"status": "affected", "version": "GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier"}]}], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on the published site's server via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "Path Traversal", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-12-24T06:30:32", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://groupsession.jp/info/info-news/security20211220"}, {"tags": ["x_refsource_MISC"], "url": "https://jvn.jp/en/jp/JVN79798166/index.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2021-20876", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "GroupSession Free edition, GroupSession byCloud, GroupSession ZION", "version": {"version_data": [{"version_value": "GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier"}]}}]}, "vendor_name": "Japan Total System Co.,Ltd."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on the published site's server via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Path Traversal"}]}]}, "references": {"reference_data": [{"name": "https://groupsession.jp/info/info-news/security20211220", "refsource": "MISC", "url": "https://groupsession.jp/info/info-news/security20211220"}, {"name": "https://jvn.jp/en/jp/JVN79798166/index.html", "refsource": "MISC", "url": "https://jvn.jp/en/jp/JVN79798166/index.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:53:23.073Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://groupsession.jp/info/info-news/security20211220"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jvn.jp/en/jp/JVN79798166/index.html"}]}]}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2021-20876", "datePublished": "2021-12-24T06:30:32", "dateReserved": "2020-12-17T00:00:00", "dateUpdated": "2024-08-03T17:53:23.073Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:cloud:*:*:*", "matchCriteriaId": "D0AB1821-FA7C-41F4-9F3D-D61B778385F9", "versionEndIncluding": "5.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:free:*:*:*", "matchCriteriaId": "B51AF142-FBF4-4602-BFD4-DD71D0EB0C3E", "versionEndIncluding": "5.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:groupsession:groupsession:*:*:*:*:zion:*:*:*", "matchCriteriaId": "4027BB4D-AE22-43B5-A206-94E71D7B6687", "versionEndIncluding": "5.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on the published site's server via unspecified vectors."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta en GroupSession Free edition ver5.1.1 y anteriores, GroupSession byCloud ver5.1.1 y anteriores, y GroupSession ZION ver5.1.1 y anteriores, permite a un atacante con un privilegio administrativo obtener informaci\u00f3n confidencial almacenada en la jerarqu\u00eda por encima del directorio en el servidor del sitio publicado por medio de vectores no especificados"}], "id": "CVE-2021-20876", "lastModified": "2022-01-10T13:21:36.353", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-12-24T07:15:06.790", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://groupsession.jp/info/info-news/security20211220"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN79798166/index.html"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}