← Back

CVE-2021-35975

nvd nist
Published: Nov 30, 2023Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.777) allows remote attackers to read arbitrary files via a full pathname in GET parameter "file" in URL. Also: affected components in same product - HTTP Adapter (up to v.1.8.0.15), MSSQL MessageBus Proxy (up to v.1.1.06), Financial Calculator (up to v.1.3.05), FIX Adapter (up to v.2.4.0.25)

Affected (6)

Systematica
6 products
Financial Calculator
Fix Adapter
Http Adapter
Mssql Messagebus Proxy
Radius
Smtp Adapter
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Financial Calculator
Up to 1.3.05
Fix Adapter
Up to 2.4.0.25
Http Adapter
Up to 1.8.0.15
Mssql Messagebus Proxy
Up to 1.1.06
Radius
Up to 3.9.256.777
Smtp Adapter
Up to 2.0.1.101

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

Source: cve@mitre.org
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.