CVE-2021-48013 Weaver Network Co., Ltd. CVE debrief

Who should care

Defenders and administrators of Weaver E-cology 8.0 deployments should assess exposure and prioritize remediation due to the potential for sensitive file exposure. This includes verifying affected versions, reviewing compensating controls, and monitoring for suspicious activity related to the /weaver/ln.FileDownload endpoint. Security teams should also track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2021-48013 is a high-severity vulnerability in Weaver E-cology 8.0 that allows unauthenticated path traversal, potentially leading to sensitive file exposure. Defenders and administrators should assess exposure, prioritize remediation, and verify affected versions and remediation status.

• Potential exposure of sensitive files such as WEB-INF/web.xml.
• Possible unauthorized access to sensitive information.
• Need for verification of affected versions and remediation status.
• Potential for exploitation requires verification from official sources.

Technical summary

Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. The vulnerability allows attackers to send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18. The vulnerability has a high severity score of 8.7 and is considered a high priority for verification and remediation.

Defensive priority

High priority for verification and remediation due to potential for sensitive file exposure.

Recommended defensive actions

• Verify the presence of Weaver E-cology 8.0 in your environment and assess exposure.
• Restrict access to the /weaver/ln.FileDownload endpoint.
• Implement input validation and sanitization for the fpath parameter.
• Monitor for suspicious activity related to the /weaver/ln.FileDownload endpoint.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.