CVE-2021-38146

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-22 · updated 2026-06-17
Weakness: CWE-22

Description

The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data.

Affected products

Wipro Holmes: 20.4.1

References

http://packetstormsecurity.com/files/164970/Wipro-Holmes-Orchestrator-20.4.1-Arbitrary-File-Download.html
https://www.wipro.com/holmes/
http://packetstormsecurity.com/files/164970/Wipro-Holmes-Orchestrator-20.4.1-Arbitrary-File-Download.html
https://www.wipro.com/holmes/

Get alerted when CVE-2021-38146 or the next vulnerability affects your stack