CVE-2021-38147

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel, processexecution/DownloadExcelFile/User_Report_Excel, processexecution/DownloadExcelFile/Process_Report_Excel, processexecution/DownloadExcelFile/Infrastructure_Report_Excel, or processexecution/DownloadExcelFile/Resolver_Report_Excel.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/165039/Wipro-Holmes-Orchestrator-20.4.1-Report-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://www.wipro.com/holmes/Product
http://packetstormsecurity.com/files/165039/Wipro-Holmes-Orchestrator-20.4.1-Report-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
https://www.wipro.com/holmes/Product

Timeline

Published: Nov 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-381489.8Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.CVE-2021-381495.4index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-38159.8utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-381506.5When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP CVE-2021-381515.4index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-381525.4index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.CVE-2021-381535.9Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute for CVE-2021-381547.5Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP CVE-2021-381557.5OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclo CVE-2021-381565.4In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.CVE-2021-381576.1LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerabil CVE-2021-381599.8In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow