CVEvulnerability
CVE-2021-4463
8.7 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2025-11-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weaknesses
- CWE-22, CWE-552
Description
Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.
Related
References
- https://cxsecurity.com/issue/WLB-2021070173 cxsecurity.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/206477 exchange.xforce.ibmcloud.com
- https://packetstormsecurity.com/files/163702 packetstormsecurity.com
- https://web.archive.org/web/20220527162453/http://www.ljkj2012.com/ web.archive.org
- https://www.exploit-db.com/exploits/50163 www.exploit-db.com
- https://www.vulncheck.com/advisories/longjing-technology-bems-api-remote-arbitrary-file-download www.vulncheck.com
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php www.zeroscience.mk