{"id":"CVE-2021-29024","aliases":["EUVD-2021-15670","GHSA-q48v-hqmw-c65v"],"status":"published","title":"In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and...","description":"In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01642,"percentile":0.76718,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-552"],"published":"2021-05-17T00:00:00Z","modified":"2026-10-20T10:54:36Z","products":[{"vendor":"invoiceplane","product":"invoiceplane"}],"references":[{"url":"https://notnnor.github.io/research/2021/03/17/files-or-directories-accessible-to-external-parties-in-invoiceplane.html","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/InvoicePlane/InvoicePlane/pull/754","tags":["x_transferred","Patch","fix"]},{"url":"https://seran.github.io/research/2021/03/17/files-or-directories-accessible-to-external-parties-in-invoiceplane.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29024"},{"url":"https://github.com/advisories/GHSA-q48v-hqmw-c65v"}],"sources":{"cve":[{"id":"CVE-2021-29024","description":"In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.","status":"published","published":"2021-05-17T00:00:00Z","modified":"2026-07-29T16:15:54.15Z","updated_at":"2026-11-02T14:33:06.658806Z"}],"euvd":[{"id":"EUVD-2021-15670","description":"In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.","status":"published","published":"2021-05-17T00:00:00Z","modified":"2026-07-29T16:15:54Z","updated_at":"2026-11-02T18:02:29.807737Z"}],"ghsa":[{"id":"GHSA-q48v-hqmw-c65v","title":"In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and...","description":"In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.","status":"published","published":"2022-05-24T19:02:33Z","modified":"2026-07-29T18:32:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:09:54.335538Z"}],"nvd":[{"id":"CVE-2021-29024","description":"In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.","status":"published","published":"2021-05-17T19:15:07.79Z","modified":"2026-07-29T17:16:48.96Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:06:53.343329Z"}],"osv":[{"id":"CVE-2021-29024","description":"In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. Allowing an attacker to directory traversal and download files suppose to be private without authentication.","status":"published","published":"2021-05-17T19:15:07.79Z","modified":"2026-10-20T10:54:36.652717518Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"}]}}