WaratekVRT Sign in

CVE-2021-29425 Apache Commons IO

Affected softwareApache Commons IO
Severity6.5 Medium CVSS 3.1 3 scores
Fixed in2.7
WeaknessPath traversal (CWE-22)
Published13 Apr 2021
Updated13 Nov 2026

Description

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.

CWE-20 · Improper input validation

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 5 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 11% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by An ARMR patch file on disk for this CVE
Finding CVE has an ARMR patch rule that provides mitigation

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2021-29425.armr patch rule, ARMR 2.6 added 2021-11-24 updated 2026-03-04
Sign in to download

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Filsesystem Path Traversal

How to mitigate CVE-2021-29425

Upgrade Apache Commons IO to 2.7 or later. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

6.5 MEDIUM v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CISA-ADP Secondary published
CVSS 3.1 4.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N NVD Primary
CVSS 2.0 5.8 none AV:N/AC:M/Au:N/C:P/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2024 ↗ CPU 2024-Q3 Oracle Communications / Security (Apache Commons IO) (46.6.4, 46.6.5)
Oracle Fusion Middleware / OSB Security (Apache Commons IO) (12.2.1.4.0)
Oracle Critical Patch Update January 2024 ↗ CPU 2024-Q1 Oracle Hyperion / Security (Apache Commons IO) (11.2.14.0.000)
Oracle Utilities Applications / General (Apache Commons IO) (4.3.0.3.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Fusion Middleware / General (Apache Commons IO) (12.2.1.4.0)
Oracle Fusion Middleware / WebCenter Sites (Apache Commons IO) (12.2.1.4.0)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Financial Services Applications / Infrastructure (Apache Commons IO) (2.7, 2.8, 2.9, 3.0, 3.1, 3.2, 4.0)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Utilities Applications / System Wide (Apache Commons IO) (2.3.0.2, 2.4.0.1, 2.5.0.0-2.5.0.2)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Fusion Middleware / Centralized Thirdparty Jars (Commons IO) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
Oracle Fusion Middleware / Runtime Java agent for ODI (Apache Commons IO) (12.2.1.3.0, 12.2.1.4.0)
Oracle Insurance Applications / Framework Administrator IBFA (Apache Commons IO) (5.2.0, 5.4.0-5.6.2)
Oracle Retail Applications / Other (Apache Commons IO) (15.02, 16.0.2)
Oracle Siebel CRM / Marketing (Apache Commons IO) (22.8 and prior)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Financial Services Applications / Securities (Apache Commons IO) (5.2, 11.6-11.8, 11.10)
Oracle Health Sciences Applications / User Interface (Apache Commons IO) (2.5.2.1, 3.0.0.0)
Oracle Retail Applications / Foundation (Apache Commons IO) (16.0.3, 19.0.1)
Oracle Retail Applications / Pricing - Security (Apache Commons IO) (19.0.1)
Oracle Retail Applications / Xenvironment (Apache Commons IO) (17.0.4, 18.0.3, 19.0.2, 20.0.1)
Oracle Supply Chain / Installation Issues (Apache Commons IO) (6.2.1.0)
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle Blockchain Platform / BCS Console (Apache Commons IO) (Prior to 21.1.2)
Oracle Communications / CMP (Apache Commons IO) (12.5.0.0.0)
Oracle Communications / Database (Apache Commons IO) (8.0.0-8.1.0, 8.2.0-8.2.3)
Oracle Communications / Policy (Apache Commons IO) (1.14.0)
Oracle Communications Applications / File Upload (Apache Commons IO) (8.0.0.6.0)
Oracle Communications Applications / OSM Plugin (Apache Commons IO) (7.3.5, 7.4.0-7.4.2)
Oracle Communications Applications / OSM SDK (Apache Commons IO) (7.3, 7.4)
Oracle Communications Applications / REST Service Manager (Apache Commons IO) (12.0.0.4, 12.0.0.5)
Oracle Fusion Middleware / CDI support (Apache Commons IO) (1.4.7, 2.2.0)
Oracle Fusion Middleware / Security Framework (Apache Commons IO) (12.2.1.3.0, 12.2.1.4.0)
Oracle HealthCare Applications / FHIR Comandline (Apache Commons IO) (8.1.0)
Oracle HealthCare Applications / Health Policy Engine (Apache Commons IO) (3.0.1-3.0.4)
Oracle Insurance Applications / Architecture (Apache Commons IO) (11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1)
Oracle Insurance Applications / Architecture (Apache Commons IO) (11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1)
Oracle REST Data Services / General (Apache Commons IO) (Prior to 21.2)
Oracle Supply Chain / Security (Apache Commons IO) (9.3.6)
Oracle Systems / Tools (Apache Commons IO) (4)
Oracle Critical Patch Update January 2022 ↗ CPU 2022-Q1 Oracle Commerce / Content Acquisition System (Apache Commons IO) (11.3.2)
Oracle Communications / NRF (Apache Commons IO) (1.14.0)
Oracle Communications / UDR (Apache Commons IO) (1.14.0)
Oracle Communications Applications / Charging Controller (Apache Commons IO) (12.0)
Oracle Communications Applications / Convergence Server (Apache Commons IO) (3.0.2.2.0)
Oracle Communications Applications / Installation (Apache Commons IO) (12.0.0.3)
Oracle Construction and Engineering / Platform (Apache Commons IO) (17.7-17.12, 18.8, 19.12, 20.12, 21.12)
Oracle Financial Services Applications / Collections (Apache Commons IO) (2.3.0-2.4.1, 2.6.2, 2.7.1, 2.10.0, 2.12.0)
Oracle Financial Services Applications / Framework (Apache Commons IO) (17.2, 18.1-18.3, 19.1, 19.2, 20.1, 21.1)
Oracle Financial Services Applications / Framework (Apache Commons IO) (18.1-18.3, 19.1, 19.2, 20.1, 21.1)
Oracle Financial Services Applications / Installer & Configuration (Apache Commons IO) (8.0.8, 8.1.0, 8.1.1)
Oracle Financial Services Applications / Others (Apache Commons IO) (8.0.7-8.1.1)
Oracle Financial Services Applications / Security (Apache Commons IO) (2.3.0-2.4.1, 2.6.2, 2.7.1)
Oracle Financial Services Applications / Web UI (Apache Commons IO) (2.7.0)
Oracle Fusion Middleware / Install (Apache Commons IO) (12.2.1.4.0)
Oracle Fusion Middleware / Third Party Tools (Apache Commons IO) (12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
Oracle Retail Applications / Application Core (Apache Commons IO) (16.0.3)
Oracle Retail Applications / Application Core (Apache Commons IO) (16.0.3)
Oracle Retail Applications / RIB Kernal (Apache Commons IO) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1)
Oracle Retail Applications / RSB Installation (Apache Commons IO) (15.0.3.1, 16.0.3, 19.0.1)
Oracle Retail Applications / System Administration (Apache Commons IO) (16.0, 18.0, 19.1)
Oracle Support Tools / Diagnostic Assistant (Apache Commons IO) (Prior to 2.12.42)
Oracle Utilities Applications / Tools (Apache Commons IO) (6.0.0.1.1)
Oracle Critical Patch Update October 2021 ↗ CPU 2021-Q4 Oracle Communications / Charging (Apache Commons IO) (6.2)
Oracle Communications / Reports (Apache Commons IO) (8.0.0.0-8.2.5.0)
Oracle Communications / Route Manager (Apache Commons IO) (8.0.0.0-8.2.5.0)
Oracle Communications / Signaling (Apache Commons IO) (3.9)
Oracle Communications Applications / Administration (Apache Commons IO) (8.0.0.6.0)
Oracle Communications Applications / Message Store (Apache Commons IO) (8.1)
Oracle Communications Applications / Reports (Apache Commons IO) (6.3.1)
Oracle Construction and Engineering / Admin (Apache Commons IO) (17.12.0-17.12.11, 18.8.0-18.8.12, 19.12.0-19.12.11)
Oracle Fusion Middleware / Application Adapters (Apache Commons IO) (19.1.0.0.0)
Oracle Fusion Middleware / Console (Apache Commons IO) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
Oracle Fusion Middleware / Decision Server (Apache Commons IO) (3.2.0.0)
Oracle Hyperion / Security (Apache Commons IO) (11.1.2.4, 11.2.6.0)
Oracle Insurance Applications / Development tools (Apache Commons IO) (12.6.0 - 12.6.4)
Oracle MySQL / Monitoring: General (Apache Commons IO) (8.0.25 and prior)
Oracle PeopleSoft / Updates Change Assistant (Apache Commons IO) (8.57, 8.58)
Oracle Retail Applications / Segment (Apache Commons IO) (16.0-19.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Blockchain Platform BCS Console (Apache Commons IO) Prior to 21.1.2
Oracle Commerce Content Acquisition System (Apache Commons IO) 11.3.2 11.3.2
Oracle Communications CMP (Apache Commons IO) 12.5.0.0.0 12.5.0.0.0
Oracle Communications Charging (Apache Commons IO) 6.2 6.2
Oracle Communications Database (Apache Commons IO) 8.0.0-8.1.0, 8.2.0-8.2.3
Oracle Communications NRF (Apache Commons IO) 1.14.0 1.14.0
Oracle Communications Policy (Apache Commons IO) 1.14.0 1.14.0
Oracle Communications Reports (Apache Commons IO) 8.0.0.0-8.2.5.0
Oracle Communications Route Manager (Apache Commons IO) 8.0.0.0-8.2.5.0
Oracle Communications Security (Apache Commons IO) 46.6.4, 46.6.5 46.6.4 · 46.6.5
Oracle Communications Signaling (Apache Commons IO) 3.9 3.9
Oracle Communications UDR (Apache Commons IO) 1.14.0 1.14.0
Oracle Communications Applications Administration (Apache Commons IO) 8.0.0.6.0 8.0.0.6.0
Oracle Communications Applications Charging Controller (Apache Commons IO) 12.0 12.0
Oracle Communications Applications Convergence Server (Apache Commons IO) 3.0.2.2.0 3.0.2.2.0
Oracle Communications Applications File Upload (Apache Commons IO) 8.0.0.6.0 8.0.0.6.0
Oracle Communications Applications Installation (Apache Commons IO) 12.0.0.3 12.0.0.3
Oracle Communications Applications Message Store (Apache Commons IO) 8.1 8.1
Oracle Communications Applications OSM Plugin (Apache Commons IO) 7.3.5, 7.4.0-7.4.2 7.3.5
Oracle Communications Applications OSM SDK (Apache Commons IO) 7.3, 7.4 7.3 · 7.4
Oracle Communications Applications REST Service Manager (Apache Commons IO) 12.0.0.4, 12.0.0.5 12.0.0.4 · 12.0.0.5
Oracle Communications Applications Reports (Apache Commons IO) 6.3.1 6.3.1
Oracle Construction and Engineering Admin (Apache Commons IO) 17.12.0-17.12.11, 18.8.0-18.8.12, 19.12.0-19.12.11
Oracle Construction and Engineering Platform (Apache Commons IO) 17.7-17.12, 18.8, 19.12, 20.12, 21.12 18.8 · 19.12 · 20.12 · 21.12
Oracle Financial Services Applications Collections (Apache Commons IO) 2.3.0-2.4.1, 2.6.2, 2.7.1, 2.10.0, 2.12.0 2.6.2 · 2.7.1 · 2.10.0 · 2.12.0
Oracle Financial Services Applications Framework (Apache Commons IO) 17.2, 18.1-18.3, 19.1, 19.2, 20.1, 21.1 17.2 · 19.1 · 19.2 · 20.1 · 21.1
Oracle Financial Services Applications Infrastructure (Apache Commons IO) 2.7, 2.8, 2.9, 3.0, 3.1, 3.2, 4.0 2.7 · 2.8 · 2.9 · 3.0 · 3.1 · 3.2 · 4.0
Oracle Financial Services Applications Installer & Configuration (Apache Commons IO) 8.0.8, 8.1.0, 8.1.1 8.0.8 · 8.1.0 · 8.1.1
Oracle Financial Services Applications Others (Apache Commons IO) 8.0.7-8.1.1
Oracle Financial Services Applications Securities (Apache Commons IO) 5.2, 11.6-11.8, 11.10 5.2 · 11.10
Oracle Financial Services Applications Security (Apache Commons IO) 2.3.0-2.4.1, 2.6.2, 2.7.1 2.6.2 · 2.7.1
Oracle Financial Services Applications Web UI (Apache Commons IO) 2.7.0 2.7.0
Oracle Fusion Middleware Application Adapters (Apache Commons IO) 19.1.0.0.0 19.1.0.0.0
Oracle Fusion Middleware CDI support (Apache Commons IO) 1.4.7, 2.2.0 1.4.7 · 2.2.0
Oracle Fusion Middleware Centralized Thirdparty Jars (Commons IO) 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Console (Apache Commons IO) 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Decision Server (Apache Commons IO) 3.2.0.0 3.2.0.0
Oracle Fusion Middleware General (Apache Commons IO) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Install (Apache Commons IO) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware OSB Security (Apache Commons IO) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Runtime Java agent for ODI (Apache Commons IO) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Security Framework (Apache Commons IO) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Third Party Tools (Apache Commons IO) 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware WebCenter Sites (Apache Commons IO) 12.2.1.4.0 12.2.1.4.0
Oracle Health Sciences Applications User Interface (Apache Commons IO) 2.5.2.1, 3.0.0.0 2.5.2.1 · 3.0.0.0
Oracle HealthCare Applications FHIR Comandline (Apache Commons IO) 8.1.0 8.1.0
Oracle HealthCare Applications Health Policy Engine (Apache Commons IO) 3.0.1-3.0.4
Oracle Hyperion Security (Apache Commons IO) 11.1.2.4, 11.2.6.0 11.1.2.4 · 11.2.6.0 · 11.2.14.0.0
Oracle Insurance Applications Architecture (Apache Commons IO) 11.0.2, 11.1.0, 11.2.8, 11.3.0, 11.3.1 11.0.2 · 11.1.0 · 11.2.8 · 11.3.0 · 11.3.1
Oracle Insurance Applications Development tools (Apache Commons IO) 12.6.0 - 12.6.4
Oracle Insurance Applications Framework Administrator IBFA (Apache Commons IO) 5.2.0, 5.4.0-5.6.2 5.2.0
Oracle MySQL Monitoring: General (Apache Commons IO) 8.0.25 and prior
Oracle PeopleSoft Updates Change Assistant (Apache Commons IO) 8.57, 8.58 8.57 · 8.58
Oracle REST Data Services General (Apache Commons IO) Prior to 21.2
Oracle Retail Applications Application Core (Apache Commons IO) 16.0.3 16.0.3
Oracle Retail Applications Foundation (Apache Commons IO) 16.0.3, 19.0.1 16.0.3 · 19.0.1
Oracle Retail Applications Other (Apache Commons IO) 15.02, 16.0.2 15.2 · 16.0.2
Oracle Retail Applications Pricing - Security (Apache Commons IO) 19.0.1 19.0.1
Oracle Retail Applications RIB Kernal (Apache Commons IO) 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications RSB Installation (Apache Commons IO) 15.0.3.1, 16.0.3, 19.0.1 15.0.3.1 · 16.0.3 · 19.0.1
Oracle Retail Applications Segment (Apache Commons IO) 16.0-19.0
Oracle Retail Applications System Administration (Apache Commons IO) 16.0, 18.0, 19.1 16.0 · 18.0 · 19.1
Oracle Retail Applications Xenvironment (Apache Commons IO) 17.0.4, 18.0.3, 19.0.2, 20.0.1 17.0.4 · 18.0.3 · 19.0.2 · 20.0.1
Oracle Siebel CRM Marketing (Apache Commons IO) 22.8 and prior
Oracle Supply Chain Installation Issues (Apache Commons IO) 6.2.1.0 6.2.1.0
Oracle Supply Chain Security (Apache Commons IO) 9.3.6 9.3.6
Oracle Support Tools Diagnostic Assistant (Apache Commons IO) Prior to 2.12.42
Oracle Systems Tools (Apache Commons IO) 4 4
Oracle Utilities Applications General (Apache Commons IO) 4.3.0.3.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 4.4.0.0.0 · 4.4.0.2.0
Oracle Utilities Applications System Wide (Apache Commons IO) 2.3.0.2, 2.4.0.1, 2.5.0.0-2.5.0.2 2.3.0.2 · 2.4.0.1
Oracle Utilities Applications Tools (Apache Commons IO) 6.0.0.1.1 6.0.0.1.1

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
commons-io:commons-io 0 2.7 unbounded
com.cosium.vet:vet 1.0 none 3.22
com.diamondq.common:common-thirdparty.jcasbin unspecified none unbounded
com.liferay:com.liferay.sass.compiler.jsass unspecified none unbounded
com.virjar:ratel-api 1.0.0 none 1.3.6
net.hasor:cobble-lang 4.4.1 none 4.6.2
org.apache.commons:commons-io unspecified none unbounded
org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io 1.4 none 1.5
org.checkerframework.annotatedlib:commons-io 2.6 2.7 unbounded
org.smartboot.servlet:servlet-core 0.1.9 none 0.6

Products and versions

70 products, 144 version entries
SourceVendorProductSchemeAffected versions
nvd apache commons io generic 2.2 · 2.3 · 2.4 · 2.5 · 2.6
osv com.cosium.vet vet generic ≥ 1.0 and ≤ 3.22
osv com.diamondq.common common-thirdparty.jcasbin generic any version
osv com.liferay com.liferay.sass.compiler.jsass generic any version
osv com.virjar ratel-api generic ≥ 1.0.0 and ≤ 1.3.6
osv commons-io commons-io generic ＜ 2.7
nvd debian debian linux generic 9.0
osv net.hasor cobble-lang generic ≥ 4.4.1 and ≤ 4.6.2
nvd netapp active iq unified manager generic any version
nvd oracle access manager generic 11.1.2.3.0 · 12.2.1.3.0 · 12.2.1.4.0
nvd oracle agile engineering data management generic 6.2.1.0
nvd oracle agile product lifecycle management generic 9.3.6
nvd oracle application performance management generic 13.4.1.0 · 13.5.1.0
nvd oracle application testing suite generic 13.3.0.1
nvd oracle banking apis generic 18.1 · 18.2 · 18.3 · 19.1 · 19.2 · 20.1 · 21.1
nvd oracle banking digital experience generic 17.2 · 18.1 · 18.3 · 19.1 · 19.2 · 20.1 · 21.1
nvd oracle banking enterprise default management generic 2.6.2 · 2.7.0 · 2.7.1 · 2.10.0 · 2.12.0
nvd oracle banking enterprise default managment generic ≥ 2.3.0 and ≤ 2.4.0
nvd oracle banking party management generic 2.7.0
nvd oracle banking platform generic ≥ 2.3.0 and ≤ 2.4.1 · 2.6.2 · 2.7.0 · 2.7.1
nvd oracle blockchain platform generic ＜ 21.1.2
nvd oracle commerce guided search generic 11.3.2
nvd oracle communications application session controller generic 3.9.0
nvd oracle communications billing and revenue management elastic charging engine generic 11.3 · 12.0
nvd oracle communications cloud native core network repository function generic 1.14.0
nvd oracle communications cloud native core policy generic 1.14.0
nvd oracle communications cloud native core unified data repository generic 1.4.0
nvd oracle communications contacts server generic 8.0.0.6.0
nvd oracle communications converged application server - service controller generic 6.2
nvd oracle communications convergence generic 3.0.2.2.0
nvd oracle communications design studio generic 7.3.5 · ≥ 7.4.0 and ≤ 7.4.2
nvd oracle communications diameter intelligence hub generic ≥ 8.0.0 and ≤ 8.1.0 · ≥ 8.2.0 and ≤ 8.2.3
nvd oracle communications interactive session recorder generic 6.3 · 6.4
nvd oracle communications offline mediation controller generic 12.0.0.3
nvd oracle communications order and service management generic 7.3 · 7.4
nvd oracle communications policy management generic 12.5.0.0.0
nvd oracle communications pricing design center generic 12.0.0.4.0 · 12.0.0.5.0
nvd oracle communications service broker generic 6.2
nvd oracle enterprise communications broker generic 3.3
nvd oracle enterprise session border controller generic 8.4 · 9.0
nvd oracle financial services analytical applications infrastructure generic ≥ 8.0.7 and ≤ 8.1.1
nvd oracle financial services model management and governance generic ≥ 8.0.8 and ≤ 8.1.1
nvd oracle flexcube core banking generic 5.2.0 · ≥ 11.6.0 and ≤ 11.8.0 · 11.10.0
nvd oracle fusion middleware mapviewer generic 12.2.1.4.0
nvd oracle health sciences data management workbench generic 2.5.2.1 · 3.0.0.0
nvd oracle health sciences information manager generic ≥ 3.0.1 and ≤ 3.0.4
nvd oracle healthcare data repository generic 8.1.0
nvd oracle helidon generic 1.4.7 · 2.2.0
nvd oracle insurance policy administration generic 11.0.2 · 11.1.0 · 11.2.8 · 11.3.0 · 11.3.1
nvd oracle insurance rules palette generic 11.0.2 · 11.1.0 · 11.2.8 · 11.3.0 · 11.3.1
nvd oracle oss support tools generic ＜ 2.12.42
nvd oracle primavera unifier generic ≥ 17.7 and ≤ 17.12 · 18.8 · 19.12 · 20.12 · 21.12
nvd oracle real user experience insight generic 13.4.1.0 · 13.5.1.0
nvd oracle rest data services generic ＜ 21.2 · 21.3
nvd oracle retail assortment planning generic 16.0.3
nvd oracle retail integration bus generic 13.0 · 14.1.3.0 · 14.1.3.2 · 15.0.3.1 · ≥ 16.0.1 and ≤ 16.0.3 · 19.0.0 · 19.0.1
nvd oracle retail merchandising system generic 16.0.3 · 19.0.1
nvd oracle retail order broker generic 16.0 · 18.0 · 19.1
nvd oracle retail pricing generic 19.0.1
nvd oracle retail service backbone generic 14.1.3.0 · 14.1.3.2 · 15.0.3.1 · ≥ 16.0.1 and ≤ 16.0.3 · 19.0.0 · 19.0.1
nvd oracle retail size profile optimization generic 16.0.3
nvd oracle retail xstore point of service generic 17.0.4 · 18.0.3 · 19.0.2 · 20.0.1
nvd oracle solaris cluster generic 4.0
nvd oracle utilities testing accelerator generic 6.0.0.1.1 · 6.0.0.2.2 · 6.0.0.3.1
nvd oracle webcenter portal generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle weblogic server generic 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
osv org.apache.commons commons-io generic any version
osv org.apache.servicemix.bundles org.apache.servicemix.bundles.commons-io generic ≥ 1.4 and ≤ 1.5
osv org.checkerframework.annotatedlib commons-io generic ≥ 2.6 and ＜ 2.7
osv org.smartboot.servlet servlet-core generic ≥ 0.1.9 and ≤ 0.6

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** INSTALLER & CONFIGURATION (APACHE COMMONS IO), OTHERS (APACHE COMMONS IO), CONTENT ACQUISITION SYSTEM (APACHE COMMONS IO), DEVELOPMENT TOOLS (APACHE COMMONS IO), PLATFORM (APACHE COMMONS IO), FRAMEWORK (APACHE COMMONS IO), INSTALL (APACHE COMMONS IO), NO AUTH REMOTE EXPLOIT, CHARGING (APACHE COMMONS IO), REPORTS (APACHE COMMONS IO), DECISION SERVER (APACHE COMMONS IO), ADMINISTRATION (APACHE COMMONS IO), SECURITY (APACHE COMMONS IO), MESSAGE STORE (APACHE COMMONS IO), HTTP, TOOLS (APACHE COMMONS IO), DIAGNOSTIC ASSISTANT (APACHE COMMONS IO), NRF (APACHE COMMONS IO), ADMIN (APACHE COMMONS IO), TCP, RSB INSTALLATION (APACHE COMMONS IO), THIRD PARTY TOOLS (APACHE COMMONS IO), INSTALLATION (APACHE COMMONS IO), UDR (APACHE COMMONS IO), MULTIPLE, RIB KERNAL (APACHE COMMONS IO), MONITORING: GENERAL (APACHE COMMONS IO), COLLECTIONS (APACHE COMMONS IO), SIGNALING (APACHE COMMONS IO), CONVERGENCE SERVER (APACHE COMMONS IO), WEB UI (APACHE COMMONS IO), SYSTEM ADMINISTRATION (APACHE COMMONS IO), ROUTE MANAGER (APACHE COMMONS IO), CHARGING CONTROLLER (APACHE COMMONS IO), UPDATES CHANGE ASSISTANT (APACHE COMMONS IO), APPLICATION ADAPTERS (APACHE COMMONS IO), HTTPS, APPLICATION CORE (APACHE COMMONS IO), SEGMENT (APACHE COMMONS IO), CONSOLE (APACHE COMMONS IO) **Products:** PRIMAVERA UNIFIER, ORACLE FINANCIAL SERVICES MODEL MANAGEMENT AND GOVERNANCE, ORACLE COMMUNICATIONS SESSION ROUTE MANAGER, ORACLE SUPPORT TOOLS, HYPERION FINANCIAL MANAGEMENT, ORACLE COMMERCE, ORACLE RETAIL ASSORTMENT PLANNING, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE COMMUNICATIONS CONVERGENCE, ORACLE MYSQL, ORACLE COMMUNICATIONS CLOUD NATIVE CORE NETWORK REPOSITORY FUNCTION, ORACLE FINANCIAL SERVICES ANALYTICAL APPLICATIONS INFRASTRUCTURE, ORACLE CONSTRUCTION AND ENGINEERING, ORACLE UTILITIES TESTING ACCELERATOR, ORACLE COMMUNICATIONS APPLICATION SESSION CONTROLLER, ORACLE INSURANCE APPLICATIONS, ORACLE RETAIL CUSTOMER MANAGEMENT AND SEGMENTATION FOUNDATION, ORACLE RETAIL SIZE PROFILE OPTIMIZATION, ORACLE COMMUNICATIONS BRM - ELASTIC CHARGING ENGINE, MYSQL ENTERPRISE MONITOR, ORACLE FUSION MIDDLEWARE, ORACLE RETAIL INTEGRATION BUS, ORACLE DOCUMAKER, ORACLE BANKING PARTY MANAGEMENT, OSS SUPPORT TOOLS, ORACLE REAL-TIME DECISION SERVER, ORACLE COMMUNICATIONS CALENDAR SERVER, ORACLE HYPERION, ORACLE COMMUNICATIONS CONVERGED APPLICATION SERVER - SERVICE CONTROLLER, ORACLE FUSION MIDDLEWARE MAPVIEWER, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE UTILITIES APPLICATIONS, ORACLE BANKING DIGITAL EXPERIENCE, ORACLE BANKING PLATFORM, ORACLE COMMUNICATIONS METASOLV SOLUTION, ORACLE COMMERCE GUIDED SEARCH, ORACLE PEOPLESOFT, ORACLE RETAIL APPLICATIONS, ORACLE BANKING ENTERPRISE DEFAULT MANAGEMENT, ORACLE COMMUNICATIONS SESSION REPORT MANAGER, ORACLE COMMUNICATIONS OFFLINE MEDIATION CONTROLLER, ORACLE BANKING APIS, ORACLE COMMUNICATIONS MESSAGING SERVER, ORACLE WEBLOGIC SERVER, PRIMAVERA GATEWAY, ORACLE COMMUNICATIONS, ORACLE RETAIL SERVICE BACKBONE, ORACLE COMMUNICATIONS CLOUD NATIVE CORE UNIFIED DATA REPOSITORY, ORACLE RETAIL ORDER BROKER, ORACLE GOLDENGATE APPLICATION ADAPTERS, PEOPLESOFT ENTERPRISE PEOPLETOOLS

References

URLTags
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E WEB
https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E WEB
https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E WEB
https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E WEB
https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E WEB
https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E WEB
https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E WEB
https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E WEB
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E WEB
https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E WEB

Timeline
Published2021-04-13By the CVE Program.
ARMR remediation created2021-11-24Earliest commit adding this CVE's ARMR patch or security rule.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
NVD record modified2026-10-07NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.