CVE-2021-41152

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-41152
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41152.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-41152
Aliases
  • GHSA-m8j5-837g-2p3f
Published
2021-10-18T21:15:08.143Z
Modified
2026-07-09T12:20:30.368145Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system. In affected versions by manipulating the HTTP request an attacker can modify the path of a requested file download in the folder component to point to anywhere on the target system. The attack could be used to read any file accessible in the web root folder or outside, depending on the configuration of the system and the properly configured permission of the application server user. The attack requires an OpenOlat user account or the enabled guest user feature together with the usage of the folder component in a course. The attack does not allow writing of arbitrary files, it allows only reading of files and also only ready of files that the attacker knows the exact path which is very unlikely at least for OpenOlat data files. The problem is fixed in version 15.5.8 and 16.0.1 It is advised to upgrade to version 16.0.x. There are no known workarounds to fix this problem, an upgrade is necessary.

References

Affected packages

Git / github.com/openolat/openolat

Affected ranges

Type
GIT
Repo
https://github.com/openolat/openolat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a62a8864e557ba6cc70a6ef8d8af65c1a82904ee
Fixed
418bb509ffcb0e25ab4390563c6c47f0458583eb
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:frentix:openolat:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "15.5.8"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

OLAT-7.*
OLAT-7.1.0
OpenOLAT_10.*
OpenOLAT_10.0.0
OpenOLAT_10.0.1
OpenOLAT_10.0.2
OpenOLAT_10.0.3
OpenOLAT_10.0.4
OpenOLAT_10.0.5
OpenOLAT_11.*
OpenOLAT_11.3.0
OpenOLAT_12.*
OpenOLAT_12.2.0
OpenOLAT_12.3.0
OpenOLAT_13.*
OpenOLAT_13.0.0
OpenOLAT_13.0.0beta1
OpenOLAT_13.0.0beta3
OpenOLAT_13.0.0beta4
OpenOLAT_13.0.0beta5
OpenOLAT_13.0.0beta6
OpenOLAT_13.0.0beta7
OpenOLAT_13.0.0beta8
OpenOLAT_13.0.0beta9
OpenOLAT_13.2.0
OpenOLAT_14.*
OpenOLAT_14.0.0
OpenOLAT_15.*
OpenOLAT_15.0.0
OpenOLAT_15.1.0
OpenOLAT_15.2.0
OpenOLAT_15.3.0
OpenOLAT_15.4.0
OpenOLAT_15.5.0
OpenOLAT_15.5.1
OpenOLAT_15.5.2
OpenOLAT_15.5.3
OpenOLAT_15.5.4
OpenOLAT_15.5.5
OpenOLAT_15.5.6
OpenOLAT_15.5.7
OpenOLAT_15.pre.0.a
OpenOLAT_15.pre.1
OpenOLAT_15.pre.2
OpenOLAT_15.pre.3
OpenOLAT_15.pre.4
OpenOLAT_15.pre.6
OpenOLAT_15.pre.7
OpenOLAT_15.pre.9
OpenOLAT_8.*
OpenOLAT_8.1
OpenOLAT_8.1.1
OpenOLAT_8.1.2
OpenOLAT_9.*
OpenOLAT_9.0.0
OpenOLAT_9.1.0
OpenOLAT_9.2.0

Database specific

vanir_signatures_modified 
"2026-07-09T12:20:30Z"
vanir_signatures 
[
    {
        "id": "CVE-2021-41152-274fcf0b",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 714.0,
            "function_hash": "37230997893396063972597037275420143191"
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "function": "execute",
            "file": "src/main/java/org/olat/core/commons/modules/bc/commands/CmdDownloadZip.java"
        }
    },
    {
        "id": "CVE-2021-41152-6e8eb4f4",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 1167.0,
            "function_hash": "94287513934543284346126525798809755454"
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "function": "execute",
            "file": "src/main/java/org/olat/core/util/mail/ui/SendDocumentsByEMailController.java"
        }
    },
    {
        "id": "CVE-2021-41152-70757292",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "86717623330665120496031326163668972536",
                "251072242806967888073132533343962860977",
                "32457034648358490823220129595690224697",
                "301209609550344131942330964586119774150"
            ]
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "file": "src/main/java/org/olat/core/commons/modules/bc/commands/CmdMoveCopy.java"
        }
    },
    {
        "id": "CVE-2021-41152-86108698",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 177.0,
            "function_hash": "177443095175067134906098121982549311906"
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "function": "parse",
            "file": "src/main/java/org/olat/core/commons/modules/bc/FileSelection.java"
        }
    },
    {
        "id": "CVE-2021-41152-8a38badf",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 131.0,
            "function_hash": "316052137749478707706052036295686385818"
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "function": "FileSelection",
            "file": "src/main/java/org/olat/core/commons/modules/bc/FileSelection.java"
        }
    },
    {
        "id": "CVE-2021-41152-8f363b9b",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "80473514006642633131981809312951840155",
                "292576035416766925342917472940262353435",
                "117740808469359736120830453476108969376",
                "7387780290141339411793183550064077412",
                "263746527166628539442081347357673494431",
                "192810494996494322316260305931715289967",
                "14312700508356220016356318939682885037",
                "35429673842691676284690516800972076563",
                "288814880909148013942226804586649256721",
                "35570831742568115540926112127888368929",
                "18335671290238607387389306567931678743",
                "314170263751640978805915658350740778359",
                "264012975826191915573176793306657550076",
                "320215313141988971156825230800793861826",
                "102419674002378334549789822032523371184",
                "159747880980177518406325616793548604908",
                "272804761526532695149644536912238298294",
                "148232820546822870077796324103201568980",
                "148038969776951357689338893496288131549"
            ]
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "file": "src/main/java/org/olat/core/commons/modules/bc/FileSelection.java"
        }
    },
    {
        "id": "CVE-2021-41152-93d63ba7",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 768.0,
            "function_hash": "52017343667875642092412676418143035664"
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "function": "execute",
            "file": "src/main/java/org/olat/core/commons/modules/bc/commands/CmdDelete.java"
        }
    },
    {
        "id": "CVE-2021-41152-9e869568",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "225388238040251574302750543747225967216",
                "76441486433985649060461301908988838409",
                "78352974792646237695172154405455682498",
                "39455147565886489597818479157511151483"
            ]
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "file": "src/main/java/org/olat/core/commons/modules/bc/commands/CmdUnzip.java"
        }
    },
    {
        "id": "CVE-2021-41152-a8a6172a",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 2074.0,
            "function_hash": "268990702816256723651842358809507242008"
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "function": "execute",
            "file": "src/main/java/org/olat/core/commons/modules/bc/commands/CmdUnzip.java"
        }
    },
    {
        "id": "CVE-2021-41152-cfaef401",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "123791303460811432165340330782384170349",
                "10198707096846964694593697707696736481",
                "185605951606308260193390768106158895762",
                "90292922356063283910587630187143750303"
            ]
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "file": "src/main/java/org/olat/core/commons/modules/bc/commands/CmdZip.java"
        }
    },
    {
        "id": "CVE-2021-41152-e0809bf2",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "70951686129651440150823223013879687099",
                "252185366706045822254390248742329713726",
                "223759349789669610664831824445686231615",
                "330355830692705847943950553386861311013",
                "136279414941798873184847191427013089239",
                "246131234933140273026774056169337191357",
                "155137073474341561455083345948672522724",
                "245482034438282721179187193260640106826"
            ]
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "file": "src/main/java/org/olat/core/commons/modules/bc/commands/CmdDownloadZip.java"
        }
    },
    {
        "id": "CVE-2021-41152-e7a4a68d",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 1013.0,
            "function_hash": "173650894009391771760842423909294262635"
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "function": "execute",
            "file": "src/main/java/org/olat/core/commons/modules/bc/commands/CmdMoveCopy.java"
        }
    },
    {
        "id": "CVE-2021-41152-e874b74e",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "98366211884560439465393510581894364779",
                "132300245631748378012871120704563567370",
                "328699086517979105903591411128201873414",
                "201149948614933999970105145621268051840"
            ]
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "file": "src/main/java/org/olat/core/commons/modules/bc/commands/CmdDelete.java"
        }
    },
    {
        "id": "CVE-2021-41152-f1adb6fa",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 819.0,
            "function_hash": "267528097173220458552165884497255948505"
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "function": "execute",
            "file": "src/main/java/org/olat/core/commons/modules/bc/commands/CmdZip.java"
        }
    },
    {
        "id": "CVE-2021-41152-fa675aec",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "70951686129651440150823223013879687099",
                "252185366706045822254390248742329713726",
                "223759349789669610664831824445686231615",
                "330355830692705847943950553386861311013"
            ]
        },
        "source": "https://github.com/openolat/openolat/commit/418bb509ffcb0e25ab4390563c6c47f0458583eb",
        "target": {
            "file": "src/main/java/org/olat/core/util/mail/ui/SendDocumentsByEMailController.java"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41152.json"