CVE-2021-48013: Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for investigation?
Weaver E-cology 8.0 deployments with the /weaver/ln.FileDownload endpoint reachable over the network should be prioritized, because exploitation does not require authentication.
What does an attacker need to exploit this issue?
An attacker can send a crafted GET request to the affected endpoint and supply directory-traversal sequences in the fpath parameter. No valid account or user interaction is required.
Has exploitation been observed in the wild?
Yes. The Shadowserver Foundation first observed exploitation evidence on 2023-10-18.