CVE-2021-44140

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache JSPWiki	>= Apache JSPWiki, <= 2.11.0.M8

References

https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-44140Vendor Advisory
https://lists.apache.org/thread/5qglpjdhvobppx7j550lf1sk28f6011tMailing List, Vendor Advisory
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2021-44140Vendor Advisory
https://lists.apache.org/thread/5qglpjdhvobppx7j550lf1sk28f6011tMailing List, Vendor Advisory

Timeline

Published: Nov 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-441414.3All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists CVE-2021-441428.8The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and intero CVE-2021-441439.8A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a c CVE-2021-441449.1Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date.CVE-2021-441456.5In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included maliciou CVE-2021-441475.5An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose loc CVE-2021-441486.1GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an S CVE-2021-441497.8An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks secu CVE-2021-44154.3The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is du CVE-2021-441507.5The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content.CVE-2021-441517.5An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessions by bruteforcing CVE-2021-441529.8An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or authorization, an una