CVE-2021-20876 Path traversal in GroupSession Free edition, GroupSession byCloud, GroupSession ZION

Medium 6.8 Published 24 Dec 2021 Updated 3 Aug 2024

Administrators can exploit a path traversal flaw to read sensitive files outside the web root in GroupSession collaboration software.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-20876?

CVE-2021-20876 is a medium-severity path traversal vulnerability in Japan Total System Co.,Ltd. GroupSession Free edition, GroupSession byCloud, GroupSession ZION, published on 24 Dec 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZION ver5.1.1 and earlier allows an attacker with an administrative privilege to obtain sensitive information stored in the hierarchy above the directory on the published site's server via unspecified vectors.

Weakness: CWE-22

Which versions are affected by CVE-2021-20876?

It affects 1 product.

Products include Groupsession Groupsession.

How do I fix CVE-2021-20876?

No fix has been published for CVE-2021-20876 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-20876 being exploited?

There is no known exploitation of CVE-2021-20876 in the wild and no public exploit code.

Sources

Also known as GHSA-wgqf-h79v-9gc7.