CVE-2021-38417

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
VISAM	VBASE Pro-RT/ Server-RT (Web Remote)	version 11.6.0.6

References

https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-21-308-01Third Party Advisory, US Government Resource

Timeline

Published: Jul 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-384185.9Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traff CVE-2021-384197.8Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds write, which can result in data CVE-2021-38427.5nltk is vulnerable to Inefficient Regular Expression Complexity CVE-2021-384207.8Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which m CVE-2021-384217.1Fuji Electric V-Server Lite and Tellus Lite V-Simulator prior to v4.0.12.0 is vulnerable to an out-of-bounds read, which may allow an attack CVE-2021-384227.8Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensiv CVE-2021-384239.8All versions of GurumDDS improperly calculate the size to be used when allocating the buffer, which may result in a buffer overflow.CVE-2021-384247.8The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data.CVE-2021-384259.1eProsima Fast DDS versions prior to 2.4.0 (#2269) are susceptible to exploitation when an attacker sends a specially crafted packet to flood CVE-2021-384267.8FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could CVE-2021-384277.8RTI Connext DDS Professional and Connext DDS Secure Versions 4.2.x to 6.1.0 are vulnerable to a stack-based buffer overflow, which may allow CVE-2021-384284.8Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbi