CVE-2021-37533 Apache Commons Net
| Affected software | Apache Commons Net |
|---|---|
| Severity | 6.5 Medium CVSS 3.1 2 scores |
| Fixed in | 3.9.0 |
| Weakness | Improper input validation (CWE-20) |
| Published | 3 Dec 2022 |
| Updated | 17 Jun 2026 |
Description
Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 3 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 2.2% chance in 30 days
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
VRT has not found a public code change for this CVE yet.
- Protection none
- Action not pursued
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to No source fix or exploit. |
CVSS
6.5 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
2 metrics
CVSS
6.5 MEDIUM v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 3.1 | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
CISA-ADP | Secondary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2024 ↗ | CPU | 2024-Q3 | Oracle Analytics / Mapviewer (Apache Commons FileUpload) (Prior to 7.8.0) Oracle Communications / Security (Apache Commons Net) (46.6.4, 46.6.5) Oracle Communications Applications / JCA Adaptor (Apache Commons Net) (12.0.0.4.0-12.0.0.8.0) Oracle Enterprise Manager / Install (Apache Commons Net) (13.5.0.0) Oracle Fusion Middleware / Content Server (Apache Commons Net) (12.2.1.4.0) Oracle Fusion Middleware / Rest Service (Apache Commons Net) (12.2.1.4.0) |
| Oracle Critical Patch Update April 2024 ↗ | CPU | 2024-Q2 | Oracle Communications Applications / General (Apache Commons Net) (12.0.0.1-12.0.0.8) Oracle PeopleSoft / Third Party (Apache Commons Net) (9.2) Oracle Systems / Tools (Apache Commons Net) (4) |
| Oracle Critical Patch Update January 2024 ↗ | CPU | 2024-Q1 | Oracle Communications Applications / Order and Service Management (Apache Commons Net) (7.4.0.7.0, 7.4.1.5.0, 7.4.2.8.0) Oracle Fusion Middleware / Third Party (Apache Commons Net) (12.2.1.4.0) |
| Oracle Critical Patch Update October 2023 ↗ | CPU | 2023-Q4 | Oracle Commerce / Content Acquisition System (Apache Commons Net) (11.3.2) Oracle Communications / BEServer (Apache Commons Net) (9.0.0-9.0.2) Oracle Communications / BEServer (Apache Commons Net) (9.0.0-9.0.2) Oracle Communications Applications / Network Processor (Apache Commons Net) (7.4.0, 7.5.0) Oracle Financial Services Applications / Installer (Apache Commons Net) (8.1.2.3, 8.1.2.4) Oracle Financial Services Applications / Security (Apache Commons Net) (11.6-11.8, 11.10, 11.11) Oracle Siebel CRM / Marketing (Apache Commons Net) (23.8 and prior) |
| Oracle Critical Patch Update July 2023 ↗ | CPU | 2023-Q3 | Oracle Analytics / Service Administration UI (Apache Commons Net) (6.4.0.0.0) Oracle Communications Applications / Other (Apache Commons Net) (7.3.6.4) Oracle Construction and Engineering / Admin (Apache Commons Net) (18.8.0-18.8.15, 19.12.0-19.12.16, 20.12.0-20.12.11, 21.12.0-21.12.9) Oracle Financial Services Applications / Infra Code (Apache Commons Net) (14.5-14.7) Oracle Financial Services Applications / Infrastructure (Apache Commons Net) (14.0-14.3, 14.5-14.7) Oracle Financial Services Applications / Infrastructure (Apache Commons Net) (14.0-14.7) Oracle Financial Services Applications / Infrastructure Code (Apache Commons Net) (14.7.0.0.0) Oracle Financial Services Applications / Payments Core (Apache Commons Net) (14.5-14.7) Oracle Financial Services Applications / core module (Apache Commons Net) (14.0-14.3, 14.5-14.7) Oracle Fusion Middleware / Generic Unix Connector (Apache Commons Net) (12.2.1.3.0) Oracle Insurance Applications / Docupresentment Server and Documaker Connector (Apache Commons Net) (12.6.1-12.7.1) Oracle Retail Applications / RIB Kernal (Apache Commons Net) (14.2.0, 15.0.4, 16.0.3, 19.0.1) Oracle Retail Applications / RSB Installation (Apache Commons Net) (14.2.0, 15.0.4, 16.0.3, 19.0.1) Oracle Supply Chain / Security (Apache Commons Net) (9.3.6) |
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Fusion Middleware / Remote Diagnostic Agent (Apache Commons Net) (12.2.1.4.0) Oracle PeopleSoft / Integration Broker (Apache Commons Net) (8.58, 8.59, 8.60) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Support Tools / Diagnostic Assistant (Apache Commons Net) (2.12.43) Oracle Support Tools / RDA - Remote Diagnostic Agent (Apache Commons Net) (22.4.22.10.18) Oracle Support Tools / Services Tools Bundle (Apache Commons Net) (22.4.22.10.18) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | Mapviewer (Apache Commons FileUpload) | Prior to 7.8.0 | |
| Oracle Analytics | Service Administration UI (Apache Commons Net) | 6.4.0.0.0 | 6.4.0.0.0 |
| Oracle Commerce | Content Acquisition System (Apache Commons Net) | 11.3.2 | 11.3.2 |
| Oracle Communications | BEServer (Apache Commons Net) | 9.0.0-9.0.2 | |
| Oracle Communications | Security (Apache Commons Net) | 46.6.4, 46.6.5 | 46.6.4 · 46.6.5 |
| Oracle Communications Applications | General (Apache Commons Net) | 12.0.0.1-12.0.0.8 | |
| Oracle Communications Applications | JCA Adaptor (Apache Commons Net) | 12.0.0.4.0-12.0.0.8.0 | |
| Oracle Communications Applications | Network Processor (Apache Commons Net) | 7.4.0, 7.5.0 | 7.4.0 · 7.5.0 |
| Oracle Communications Applications | Order and Service Management (Apache Commons Net) | 7.4.0.7.0, 7.4.1.5.0, 7.4.2.8.0 | 7.4.0.7.0 · 7.4.1.5.0 · 7.4.2.8.0 |
| Oracle Communications Applications | Other (Apache Commons Net) | 7.3.6.4 | 7.3.6.4 |
| Oracle Construction and Engineering | Admin (Apache Commons Net) | 18.8.0-18.8.15, 19.12.0-19.12.16, 20.12.0-20.12.11, 21.12.0-21.12.9 | |
| Oracle Enterprise Manager | Install (Apache Commons Net) | 13.5.0.0 | 13.5.0.0 |
| Oracle Financial Services Applications | Infra Code (Apache Commons Net) | 14.5-14.7 | |
| Oracle Financial Services Applications | Infrastructure (Apache Commons Net) | 14.0-14.3, 14.5-14.7 | |
| Oracle Financial Services Applications | Infrastructure Code (Apache Commons Net) | 14.7.0.0.0 | 14.7.0.0.0 |
| Oracle Financial Services Applications | Installer (Apache Commons Net) | 8.1.2.3, 8.1.2.4 | 8.1.2.3 · 8.1.2.4 |
| Oracle Financial Services Applications | Payments Core (Apache Commons Net) | 14.5-14.7 | |
| Oracle Financial Services Applications | Security (Apache Commons Net) | 11.6-11.8, 11.10, 11.11 | 11.10 · 11.11 |
| Oracle Financial Services Applications | core module (Apache Commons Net) | 14.0-14.3, 14.5-14.7 | |
| Oracle Fusion Middleware | Content Server (Apache Commons Net) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Generic Unix Connector (Apache Commons Net) | 12.2.1.3.0 | 12.2.1.3.0 |
| Oracle Fusion Middleware | Remote Diagnostic Agent (Apache Commons Net) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Rest Service (Apache Commons Net) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Third Party (Apache Commons Net) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Insurance Applications | Docupresentment Server and Documaker Connector (Apache Commons Net) | 12.6.1-12.7.1 | |
| Oracle PeopleSoft | Integration Broker (Apache Commons Net) | 8.58, 8.59, 8.60 | 8.58 · 8.59 · 8.60 |
| Oracle PeopleSoft | Third Party (Apache Commons Net) | 9.2 | 9.2 |
| Oracle Retail Applications | RIB Kernal (Apache Commons Net) | 14.2.0, 15.0.4, 16.0.3, 19.0.1 | 14.2.0 · 15.0.4 · 16.0.3 · 19.0.1 |
| Oracle Retail Applications | RSB Installation (Apache Commons Net) | 14.2.0, 15.0.4, 16.0.3, 19.0.1 | 14.2.0 · 15.0.4 · 16.0.3 · 19.0.1 |
| Oracle Siebel CRM | Marketing (Apache Commons Net) | 23.8 and prior | |
| Oracle Supply Chain | Security (Apache Commons Net) | 9.3.6 | 9.3.6 |
| Oracle Support Tools | Diagnostic Assistant (Apache Commons Net) | 2.12.43 | 2.12.43 |
| Oracle Support Tools | RDA - Remote Diagnostic Agent (Apache Commons Net) | 22.4.22.10.18 | 22.4.22.10.18 |
| Oracle Support Tools | Services Tools Bundle (Apache Commons Net) | 22.4.22.10.18 | 22.4.22.10.18 |
| Oracle Systems | Tools (Apache Commons Net) | 4 | 4 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
commons-net:commons-net |
0 | 3.9.0 |
unbounded |
Products and versions
3 products, 4 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | commons net | generic | ＜ 3.9.0 |
| osv | commons-net | commons-net | generic | ＜ 3.9.0 |
| nvd | debian | debian linux | generic | 10.0 · 11.0 |
References
Timeline
Timeline
| Published | 2022-12-03 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |