CVE-2021-29425: commons io 2.2, 2.3, 2.4 (+2 more affected versions); +60 more affected products

Affected technology

commons io · 2.2
apache

commons io · 2.3
apache

commons io · 2.4
apache

commons io · 2.5
apache

commons io · 2.6
apache

debian linux · 9.0
debian

access manager · 11.1.2.3.0
oracle

access manager · 12.2.1.3.0
oracle

access manager · 12.2.1.4.0
oracle

agile engineering data management · 6.2.1.0
oracle

agile product lifecycle management · 9.3.6
oracle

application performance management · 13.4.1.0
oracle

application performance management · 13.5.1.0
oracle

application testing suite · 13.3.0.1
oracle

banking apis · 18.1
oracle

banking apis · 18.2
oracle

banking apis · 18.3
oracle

banking apis · 19.1
oracle

banking apis · 19.2
oracle

banking apis · 20.1
oracle

banking apis · 21.1
oracle

banking digital experience · 17.2
oracle

banking digital experience · 18.1
oracle

banking digital experience · 18.3
oracle

banking digital experience · 19.1
oracle

banking digital experience · 19.2
oracle

banking digital experience · 20.1
oracle

banking digital experience · 21.1
oracle

banking enterprise default management · 2.6.2
oracle

banking enterprise default management · 2.7.0
oracle

banking enterprise default management · 2.7.1
oracle

banking enterprise default management · 2.10.0
oracle

banking enterprise default management · 2.12.0
oracle

banking enterprise default managment · from 2.3.0 (inclusive), through 2.4.0 (inclusive)
oracle

banking party management · 2.7.0
oracle

banking platform · from 2.3.0 (inclusive), through 2.4.1 (inclusive)
oracle

banking platform · 2.6.2
oracle

banking platform · 2.7.0
oracle

banking platform · 2.7.1
oracle

blockchain platform · before 21.1.2 (exclusive)
oracle

commerce guided search · 11.3.2
oracle

communications application session controller · 3.9.0
oracle

communications billing and revenue management elastic charging engine · 11.3
oracle

communications billing and revenue management elastic charging engine · 12.0
oracle

communications cloud native core network repository function · 1.14.0
oracle

communications cloud native core policy · 1.14.0
oracle

communications cloud native core unified data repository · 1.4.0
oracle

communications contacts server · 8.0.0.6.0
oracle

communications converged application server - service controller · 6.2
oracle

communications convergence · 3.0.2.2.0
oracle

communications design studio · from 7.4.0 (inclusive), through 7.4.2 (inclusive)
oracle

communications design studio · 7.3.5
oracle

communications diameter intelligence hub · from 8.0.0 (inclusive), through 8.1.0 (inclusive)
oracle

communications diameter intelligence hub · from 8.2.0 (inclusive), through 8.2.3 (inclusive)
oracle

communications interactive session recorder · 6.3
oracle

communications interactive session recorder · 6.4
oracle

communications offline mediation controller · 12.0.0.3
oracle

communications order and service management · 7.3
oracle

communications order and service management · 7.4
oracle

communications policy management · 12.5.0.0.0
oracle

communications pricing design center · 12.0.0.4.0
oracle

communications pricing design center · 12.0.0.5.0
oracle

communications service broker · 6.2
oracle

enterprise communications broker · 3.3
oracle

enterprise session border controller · 8.4
oracle

enterprise session border controller · 9.0
oracle

financial services analytical applications infrastructure · from 8.0.7 (inclusive), through 8.1.1 (inclusive)
oracle

financial services model management and governance · from 8.0.8 (inclusive), through 8.1.1 (inclusive)
oracle

flexcube core banking · from 11.6.0 (inclusive), through 11.8.0 (inclusive)
oracle

flexcube core banking · 5.2.0
oracle

flexcube core banking · 11.10.0
oracle

fusion middleware mapviewer · 12.2.1.4.0
oracle

health sciences data management workbench · 2.5.2.1
oracle

health sciences data management workbench · 3.0.0.0
oracle

health sciences information manager · from 3.0.1 (inclusive), through 3.0.4 (inclusive)
oracle

healthcare data repository · 8.1.0
oracle

helidon · 1.4.7
oracle

helidon · 2.2.0
oracle

insurance policy administration · 11.0.2
oracle

insurance policy administration · 11.1.0
oracle

insurance policy administration · 11.2.8
oracle

insurance policy administration · 11.3.0
oracle

insurance policy administration · 11.3.1
oracle

insurance rules palette · 11.0.2
oracle

insurance rules palette · 11.1.0
oracle

insurance rules palette · 11.2.8
oracle

insurance rules palette · 11.3.0
oracle

insurance rules palette · 11.3.1
oracle

oss support tools · before 2.12.42 (exclusive)
oracle

primavera unifier · from 17.7 (inclusive), through 17.12 (inclusive)
oracle

primavera unifier · 18.8
oracle

primavera unifier · 19.12
oracle

primavera unifier · 20.12
oracle

primavera unifier · 21.12
oracle

real user experience insight · 13.4.1.0
oracle

real user experience insight · 13.5.1.0
oracle

rest data services · before 21.2 (exclusive)
oracle

rest data services · 21.3
oracle

retail assortment planning · 16.0.3
oracle

retail integration bus · from 16.0.1 (inclusive), through 16.0.3 (inclusive)
oracle

retail integration bus · 13.0
oracle

retail integration bus · 14.1.3.0
oracle

retail integration bus · 14.1.3.2
oracle

retail integration bus · 15.0.3.1
oracle

retail integration bus · 19.0.0
oracle

retail integration bus · 19.0.1
oracle

retail merchandising system · 16.0.3
oracle

retail merchandising system · 19.0.1
oracle

retail order broker · 16.0
oracle

retail order broker · 18.0
oracle

retail order broker · 19.1
oracle

retail pricing · 19.0.1
oracle

retail service backbone · from 16.0.1 (inclusive), through 16.0.3 (inclusive)
oracle

retail service backbone · 14.1.3.0
oracle

retail service backbone · 14.1.3.2
oracle

retail service backbone · 15.0.3.1
oracle

retail service backbone · 19.0.0
oracle

retail service backbone · 19.0.1
oracle

retail size profile optimization · 16.0.3
oracle

retail xstore point of service · 17.0.4
oracle

retail xstore point of service · 18.0.3
oracle

retail xstore point of service · 19.0.2
oracle

retail xstore point of service · 20.0.1
oracle

solaris cluster · 4.0
oracle

utilities testing accelerator · 6.0.0.1.1
oracle

utilities testing accelerator · 6.0.0.2.2
oracle

utilities testing accelerator · 6.0.0.3.1
oracle

webcenter portal · 12.2.1.3.0
oracle

webcenter portal · 12.2.1.4.0
oracle

weblogic server · 12.1.3.0.0
oracle

weblogic server · 12.2.1.3.0
oracle

weblogic server · 12.2.1.4.0
oracle

weblogic server · 14.1.1.0.0
oracle

active iq unified manager · Version not applicable in the source CPE
netapp

Apache Commons IO · Apache Commons IO 2.2, Apache Commons IO 2.3, Apache Commons IO 2.4, Apache Commons IO 2.5, Apache Commons IO 2.6
Apache Software Foundation

Description’s affected range: before 2.7

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 4.8/10) rates confidentiality and integrity impact as low; availability impact as none. Source advisory’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.