« Volver al listado

CVE-2021-33800

Estado: ModificadaAlta (7.5)—

In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Alibaba — Druid

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-33800",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "alibaba-cna@list.alibaba-inc.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Druid",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-11-03T20:15:08.303",
  "references": [
    {
      "url": "https://security.alibaba.com/announcement/announcement?id=214",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "alibaba-cna@list.alibaba-inc.com"
    },
    {
      "url": "https://security.alibaba.com/announcement/announcement?id=214",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal."
    },
    {
      "lang": "es",
      "value": "En Druid versión 1.2.3, la visita a la ruta con parámetro en una determinada función puede conllevar a un salto de directorio"
    }
  ],
  "lastModified": "2026-06-17T03:55:15.357",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:alibaba:druid:1.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A46F6688-BA4E-43DC-90FF-BBAA84E87744"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "alibaba-cna@list.alibaba-inc.com"
}