PT-2021-20526 · Eclipse · Eclipse Birt

Stu Xxn · Published 2021-06-25 · Updated 2025-11-29 · CVE-2021-34427

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse BIRT versions 4.8.0 and earlier

Description An attacker can use query parameters to create a JavaServer Pages (JSP) file accessible remotely, allowing for the injection of JSP code into the running instance. This could lead to remote code execution.

Recommendations Versions prior to 4.8.0 should be updated.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

CWE-20

Related Identifiers

CVE-2021-34427

Affected Products

Eclipse Birt

References · 10

• 🔥 http://seclists.org/fulldisclosure/2022/Dec/30 · Exploit
• 🔥 https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142 · Exploit
• 🔥 http://packetstormsecurity.com/files/170326/Eclipse-Business-Intelligence-Reporting-Tool-4.11.0-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-34427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34427 · Security Note
• https://twitter.com/pdnuclei_bot/status/1994711624868139124 · Twitter Post
• https://t.me/cvenotify/40405 · Telegram Post
• https://t.me/cvenotify/44132 · Telegram Post
• https://t.me/cvenotify/16949 · Telegram Post
• https://t.me/cvenotify/16759 · Telegram Post