CVSS 3.1
9.1 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HCVE-2021-44140
Critical (9.1) in apache jspwiki. EPSS 6.4% chance of exploitation in the next 30 days. Fixed in org.apache.jspwiki:jspwiki-main 2.11.0.
Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.
Severity
- EPSS
- 6.4% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-276
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:jspwiki
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8gw6-w5rw-4g5c | Maven | org.apache.jspwiki:jspwiki-main | <2.11.0 | 2.11.0 |