CVE-2021-28172 Vangene deltaFlow E-platform - Path Traversal

High 7.5 Published 6 Apr 2021 Updated 17 Sep 2024

Remote attackers can exploit a path traversal flaw in the file download function to access sensitive credential data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-28172?

CVE-2021-28172 is a high-severity path traversal vulnerability in Vangene deltaFlow E-platform, published on 6 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

There is a Path Traversal vulnerability in the file download function of Vangene deltaFlow E-platform. Remote attackers can access credential data with this leakage.

Weakness: CWE-22

Which versions are affected by CVE-2021-28172?

It affects 1 product.

Products include Deltaflow Project Deltaflow.

How do I fix CVE-2021-28172?

No fix has been published for CVE-2021-28172 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-28172 being exploited?

There is no known exploitation of CVE-2021-28172 in the wild and no public exploit code.

Sources

Also known as GHSA-jx2q-6pqj-6v8p.