CVE-2021-22028

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

In versions of Greenplum database prior to 5.28.6 and 6.14.0, greenplum database contains a file path traversal vulnerability leading to information disclosure from the file system. A malicious user can read/write information from the file system using this vulnerability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	gpfdist (Greenplum)	gpfdist (Greenplum) versions 6.x.0 prior to 6.14.0 and 5.28.x prior to 5.28.6

References

https://github.com/greenplum-db/gpdb/security/advisories/GHSA-hqh5-m87w-57w2Patch, Third Party Advisory
https://github.com/greenplum-db/gpdb/security/advisories/GHSA-hqh5-m87w-57w2Patch, Third Party Advisory

Timeline

Published: Nov 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-220297.5VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session co CVE-2021-22034.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.23 an CVE-2021-220306.5In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) info CVE-2021-220332.7Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability.CVE-2021-220347.5Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability.CVE-2021-220354.3VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics export CVE-2021-220366.5VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor ma CVE-2021-220377.8Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the co CVE-2021-220388.8On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller ex CVE-2021-22045.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2021-220406.7VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local adminis CVE-2021-220416.7VMware ESXi, Workstation, and Fusion contain a double-fetch vulnerability in the UHCI USB controller. A malicious actor with local administr