{"id":"CVE-2021-40745","aliases":["EUVD-2021-27910","GHSA-22xh-v97v-2c2w"],"status":"published","title":"Adobe Campaign Path Traversal Leads to Information Exposure","description":"Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03722,"percentile":0.89887,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2021-11-17T15:44:04Z","modified":"2026-06-17T04:07:22Z","products":[{"vendor":"adobe","product":"campaign"}],"references":[{"url":"https://helpx.adobe.com/security/products/campaign/apsb21-52.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40745"},{"url":"https://github.com/advisories/GHSA-22xh-v97v-2c2w"}],"sources":{"cve":[{"id":"CVE-2021-40745","title":"Adobe Campaign Path Traversal Leads to Information Exposure","description":"Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server.","status":"published","published":"2021-11-17T15:44:04.875Z","modified":"2025-04-23T19:22:16.543Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:01.852999Z"}],"euvd":[{"id":"EUVD-2021-27910","description":"Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server.","status":"published","published":"2021-11-17T15:44:04Z","modified":"2025-04-23T19:22:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:06.372143Z"}],"ghsa":[{"id":"GHSA-22xh-v97v-2c2w","title":"Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that...","description":"Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server.","status":"published","published":"2022-05-24T19:20:42Z","modified":"2023-01-30T05:03:55Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:46:56.128795Z"}],"nvd":[{"id":"CVE-2021-40745","description":"Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server.","status":"published","published":"2021-11-17T16:15:08.95Z","modified":"2026-06-17T04:07:22.347Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:01.428028Z"}]}}