CVE-2021-41381

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Payara Micro Community 5.2021.6 and below allows Directory Traversal.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/164365/Payara-Micro-Community-5.2021.6-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/169864/Payara-Platform-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Nov/11Exploit, Mailing List, Third Party Advisory
https://github.com/Net-hunter121/CVE-2021-41381/blob/main/CVE:%202021-41381-POCExploit, Third Party Advisory
https://www.exploit-db.com/exploits/50371Exploit, Third Party Advisory, VDB Entry
https://www.payara.fishProduct, Vendor Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/164365/Payara-Micro-Community-5.2021.6-Directory-Traversal.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/169864/Payara-Platform-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Nov/11Exploit, Mailing List, Third Party Advisory
https://github.com/Net-hunter121/CVE-2021-41381/blob/main/CVE:%202021-41381-POCExploit, Third Party Advisory
https://www.exploit-db.com/exploits/50371Exploit, Third Party Advisory, VDB Entry
https://www.payara.fishProduct, Vendor Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txtExploit, Third Party Advisory

Timeline

Published: Sep 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-413827.5Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.CVE-2021-413837.2setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_server f CVE-2021-413856.5The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295_0302 allows an authenticated user to obtain access to server co CVE-2021-413878.8seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root.CVE-2021-413887.8Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc p CVE-2021-41399.0pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-413908.0In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Inj CVE-2021-413915.4In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XS CVE-2021-413929.8static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the CVE-2021-413939.8Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations CVE-2021-413945.3Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.CVE-2021-413956.5Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted data