Is CVE-2021-48015 being exploited?

No public exploit is currently tracked.

How severe is CVE-2021-48015?

CVE-2021-48015 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2021-48015

Description

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.