CVE-2021-32557

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-59CWE-61

Affected software

VendorProductVersions
Canonicalapport>= 2.20.1, < 2.20.1-0ubuntu2.30+esm1; >= 2.20.9, < 2.20.9-0ubuntu7.24; >= 2.20.11-0ubuntu27, < 2.20.11-0ubuntu27.18; >= 2.20.11-0ubuntu50, < 2.20.11-0ubuntu50.7; >= 2.20.11-0ubuntu65, < 2.20.11-0ubuntu65.1; >= 2.14.1-0ubuntu3, < 2.14.1-0ubuntu3.29+esm7

References

Timeline

Published
Jun 12, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-325587.5An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and CertifCVE-2021-325596.5An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that wCVE-2021-32566.5KuaiFanCMS V5.x contains an arbitrary file read vulnerability in the html_url parameter of the chakanhtml.module.php file.CVE-2021-325606.5The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.CVE-2021-325616.1OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.CVE-2021-325639.8An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delCVE-2021-325657.5Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache CVE-2021-325667.5Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache TCVE-2021-325677.5Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache TCVE-2021-325687.8mrdoc is vulnerable to Deserialization of Untrusted DataCVE-2021-325696.1In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. ThiCVE-2021-325704.9In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from cert