CVE-2021-38146

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/164970/Wipro-Holmes-Orchestrator-20.4.1-Arbitrary-File-Download.htmlExploit, Third Party Advisory, VDB Entry
https://www.wipro.com/holmes/Product
http://packetstormsecurity.com/files/164970/Wipro-Holmes-Orchestrator-20.4.1-Arbitrary-File-Download.htmlExploit, Third Party Advisory, VDB Entry
https://www.wipro.com/holmes/Product

Timeline

Published: Nov 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-381477.5Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensiti CVE-2021-381489.8Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.CVE-2021-381495.4index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-38159.8utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-381506.5When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP CVE-2021-381515.4index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-381525.4index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-381535.9Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute for CVE-2021-381547.5Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP CVE-2021-381557.5OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclo CVE-2021-381565.4In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.CVE-2021-381576.1LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerabil