PT-2021-19630 · Jump Ams+1 · Jump Ams+1

Thomas Pianezzola · Published 2021-08-03 · Updated 2021-08-12 · CVE-2021-32018

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AC:L/AV:N/A:L/C:H/I:N/PR:L/S:C/UI:N

Name of the Vulnerable Software and Affected Versions: JUMP AMS version 3.6.0.04.009-2487

Description: An issue was discovered in the JUMP SOAP API, which is vulnerable to arbitrary file reading due to an improper limitation of file loading on the server filesystem, also known as directory traversal.

Recommendations: For JUMP AMS version 3.6.0.04.009-2487, consider restricting access to the JUMP SOAP API until a patch is available. As a temporary workaround, limit the file loading on the server filesystem to prevent directory traversal. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-32018

Affected Products

Jump Ams

Jump Soap Api

References · 5

• https://osv.dev/vulnerability/CVE-2021-32018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32018 · Security Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-32018 · Note
• https://excellium-services.com/cert-xlm-advisory/cve-2021-32018 · Note
• https://t.me/cvenotify/19178 · Telegram Post