CVE-2021-41950 - CVE House
Back to Database
Status published Critical CVE-2021-41950

A directory traversal issue in ResourceSpace 9.6 before 9.6 rev...

Vulnerability Description

A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files, causing the application to become unavailable to all users.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41950

Credits & Attribution

No credits recorded in the NVD database.

References

More from montala

View All →
CVE-2022-31260
In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers...
Medium 6.5
CVE-2021-41951
ResourceSpace before 9.6 rev 18290 is affected by a reflected...
Medium 6.1
CVE-2021-41765
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and...
Critical 9.8
CVE-2015-6915
SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier...
High 7.5
CVE-2015-3648
Directory traversal vulnerability in pages/setup.php in Montala Limited ResourceSpace before...
High 7.5

Affected Vendor

Affected Software

resourcespace
Vulnerable Versions:
9.6

Timeline

Official Publish: November 15th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.