Is CVE-2021-48013 being exploited?

No public exploit is currently tracked.

How severe is CVE-2021-48013?

CVE-2021-48013 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2021-48013

Description

Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.