CVE-2021-32008 Logged-in Administrator may get unrestricted file system access

Critical 9.9 Published 4 Mar 2022 Updated 3 Aug 2024

A logged-in administrator can exploit path traversal to delete system files or directories, potentially causing denial of service or data loss.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-32008?

CVE-2021-32008 is a critical path traversal vulnerability in Secomea GateManager, published on 4 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories.

Weakness: CWE-552, CWE-22

Which versions are affected by CVE-2021-32008?

It affects 1 product.

Products include Secomea Gatemanager.

How do I fix CVE-2021-32008?

No fix has been published for CVE-2021-32008 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-32008 being exploited?

There is no known exploitation of CVE-2021-32008 in the wild and no public exploit code.

Sources

Also known as GHSA-rpq3-5j25-3mcj.