{"metadata": {"vulnerability": "CVE-2021-27850", "count": 75, "kinds": {"milestone": 4, "sighting": 47, "kev": 11, "other": 13}}, "data": [{"timestamp": "2021-03-01T00:00:00Z", "date_only": false, "value": "2021-03-01T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2021-27850", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-04-15T00:00:00Z", "date_only": true, "value": "2021-04-15", "kind": "other", "label": "Pubdate", "source": "gsd \u00b7 GSD-2021-27850", "record": "GSD-2021-27850", "field": "namespaces.gitlab.com.advisories.0.pubdate", "linked_record": true}, {"timestamp": "2021-04-15T07:40:11Z", "date_only": false, "value": "2021-04-15T07:40:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-27850", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2021-04-15T08:15:00Z", "date_only": false, "value": "2021-04-15T08:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MJ8X-CPR8-X39H", "record": "GHSA-MJ8X-CPR8-X39H", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2021-04-15T08:15:00Z", "date_only": false, "value": "2021-04-15T08:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-27850", "record": "GSD-2021-27850", "field": "namespaces.nvd.nist.gov.publishedDate", "linked_record": true}, {"timestamp": "2021-04-15T08:15:14.823Z", "date_only": false, "value": "2021-04-15T08:15:14.823", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-27850", "record": "FKIE_CVE-2021-27850", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2021-04-16T00:00:00Z", "date_only": true, "value": "2021-04-16", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2021-30869", "record": "CNVD-2021-30869", "field": "submitTime", "linked_record": true}, {"timestamp": "2021-04-19T21:38:56Z", "date_only": false, "value": "2021-04-19T21:38:56Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MJ8X-CPR8-X39H", "record": "GHSA-MJ8X-CPR8-X39H", "field": "modified", "linked_record": true}, {"timestamp": "2021-04-26T00:00:00Z", "date_only": true, "value": "2021-04-26", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2021-30869", "record": "CNVD-2021-30869", "field": "openTime", "linked_record": true}, {"timestamp": "2021-05-28T09:06:12Z", "date_only": false, "value": "2021-05-28T09:06:12.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2021-27850", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-06-02T00:00:00Z", "date_only": true, "value": "2021-06-02", "kind": "other", "label": "Date", "source": "gsd \u00b7 GSD-2021-27850", "record": "GSD-2021-27850", "field": "namespaces.gitlab.com.advisories.0.date", "linked_record": true}, {"timestamp": "2021-06-02T15:15:00Z", "date_only": false, "value": "2021-06-02T15:15Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-27850", "record": "GSD-2021-27850", "field": "namespaces.nvd.nist.gov.lastModifiedDate", "linked_record": true}, {"timestamp": "2021-06-16T17:33:19Z", "date_only": false, "value": "2021-06-16T17:33:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MJ8X-CPR8-X39H", "record": "GHSA-MJ8X-CPR8-X39H", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2021-06-26T13:47:51Z", "date_only": false, "value": "2021-06-26T13:47:51.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/3694", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "96e91f2b-f48c-4a92-bd2e-333e2b07f4da", "content": "#exploit\nA PoC for CVE-2021-27850\naffecting Apache Tapestry and leading to unauthencticated RCE\nhttps://github.com/kahla-sec/CVE-2021-27850_POC", "url": "https://t.me/CyberSecurityTechnologies/3694", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2021-06-29T17:44:18Z", "date_only": false, "value": "2021-06-29T17:44:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/canyoupwnme/6744", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "d9e8aec0-644f-49d3-9ec0-1c5a1fbb3835", "content": "CVE-2021-27850 Exploit\nhttps://github.com/kahla-sec/CVE-2021-27850_POC", "url": "https://t.me/canyoupwnme/6744", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2021-07-01T11:03:01Z", "date_only": false, "value": "2021-07-01T11:03:01.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberSecurityTechnologies/3732", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "1514445d-f3bc-4e6b-ac8e-d6a6d9117c28", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (June 1-30)\nCVE-2021-1675 - Windows Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-21985 - vSphere Client RCE\nhttps://t.me/cybersecuritytechnologies/3493\nCVE-2021-3560 - Privilege escalation with polkit\nhttps://t.me/cybersecuritytechnologies/3587\nCVE-2021-28476 - Hyper-V RCE in vmswitch.sys\nhttps://t.me/cybersecuritytechnologies/3514\nCVE-2020-3580 - XSS in Cisco ASA\nhttps://www.helpnetsecurity.com/2021/06/29/cve-2020-3580-exploit\nCVE-2021-31955/31956 - Windows NTFS EoP/Kernel Information Disclosure\nhttps://github.com/mavillon1/CVE-2021-31955-POC\nhttps://t.me/cybersecuritytechnologies/3705\nCVE-2021-33739 - MS DWM Core Library EoP\nhttps://t.me/cybersecuritytechnologies/3581\nCVE-2021-27850 - Apache Tapestry RCE\nhttps://t.me/cybersecuritytechnologies/3694\nCVE-2020-36289 - Atlassian Jira Unauth User Enum\nhttps://mobile.twitter.com/i/web/status/1402644004781633540", "url": "https://t.me/CyberSecurityTechnologies/3732"}, {"timestamp": "2021-07-22T18:06:20Z", "date_only": false, "value": "2021-07-22T18:06:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/cve_2021_27850_apache_tapestry_hmac_key.rb", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "983ec7f9-5531-4535-b0c6-41b3755849b5", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/cve_2021_27850_apache_tapestry_hmac_key.rb"}, {"timestamp": "2021-07-27T21:50:47Z", "date_only": false, "value": "2021-07-27T21:50:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackerOne/3102", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "69859d12-8849-48a9-8a85-7de4a656bf85", "content": "CVE-2021-27850 Exploit\nhttps://github.com/kahla-sec/CVE-2021-27850_POC", "url": "https://t.me/HackerOne/3102", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2021-09-21T04:42:22Z", "date_only": false, "value": "2021-09-21T04:42:22.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pwnwiki_zhchannel/712", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "868152d7-9710-4465-ab87-2edc7fc7432d", "content": "CVE-2021-27850 Apache Tapestry\u9060\u7a0b\u57f7\u884c\u4ee3\u78bc\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-27850_Apache_Tapestry%E9%81%A0%E7%A8%8B%E5%9F%B7%E8%A1%8C%E4%BB%A3%E7%A2%BC%E6%BC%8F%E6%B4%9E", "url": "https://t.me/pwnwiki_zhchannel/712"}, {"timestamp": "2023-04-27T09:58:59Z", "date_only": false, "value": "2023-04-27T09:58:59.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-27850.yaml", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "5d90efe6-2459-4486-a9f0-0d4fc2f0da94", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-27850.yaml"}, {"timestamp": "2023-10-14T14:56:55Z", "date_only": false, "value": "2023-10-14T14:56:55+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2021-27850", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "3809cc80-3dbf-4b00-8a06-62028854b045", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2023-10-14T14:56:55Z", "date_only": false, "value": "2023-10-14T14:56:55+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2021-27850", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "batch_listing": true, "uuid": "3809cc80-3dbf-4b00-8a06-62028854b045", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2023-11-17T07:08:00Z", "date_only": false, "value": "2023-11-17T07:08:00.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/arpsyndicate/228", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "335e4d23-fec6-49f8-b01a-82d39dc19ed4", "content": "#ExploitObserverAlert\n\nCVE-2021-27850\n\nDESCRIPTION: Exploit Observer has 14 entries related to CVE-2021-27850. A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.\n\nFIRST-EPSS: 0.974140000\nNVD-IS: 5.9\nNVD-ES: 3.9", "url": "https://t.me/arpsyndicate/228", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2023-12-13T01:23:35.981Z", "date_only": false, "value": "2023-12-13T01:23:35.981931Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-27850", "record": "GSD-2021-27850", "field": "gsd.osvSchema.modified", "linked_record": true}, {"timestamp": "2024-08-03T21:33:15.996Z", "date_only": false, "value": "2024-08-03T21:33:15.996Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2021-27850", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-03T21:33:15.996Z", "date_only": false, "value": "2024-08-03T21:33:15.996Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2021-27850", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-10-14T15:50:35.983Z", "date_only": false, "value": "2024-10-14T15:50:35.983245Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/92582bf5-d92c-47fe-b891-656d271bbfef", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "2adde53a-5fe6-4130-8141-c93d4b1a954a", "url": "https://vulnerability.circl.lu/bundle/92582bf5-d92c-47fe-b891-656d271bbfef"}, {"timestamp": "2024-11-09T01:33:49Z", "date_only": false, "value": "2024-11-09T01:33:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/club31337/481", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "8c88d7b1-a570-4de4-a1c4-2f9f8592d9fc", "content": "https://github.com/kahla-sec/CVE-2021-27850_POC", "url": "https://t.me/club31337/481", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2024-11-14T06:09:32Z", "date_only": false, "value": "2024-11-14T06:09:32.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/6a1f16d1-c421-4630-8ee9-fdd9660cff11", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "6151bf75-698c-4250-9b36-2b48532c19e4"}, {"timestamp": "2025-01-26T00:00:00Z", "date_only": false, "value": "2025-01-26T00:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-01-26)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "789d1ff7-f889-4899-ad08-8ecf2fac7dee"}, {"timestamp": "2025-01-30T00:00:00Z", "date_only": false, "value": "2025-01-30T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-01-30)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "5889ec79-f5c8-4a3b-b02b-3c667555b218", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-02-03T00:00:00Z", "date_only": false, "value": "2025-02-03T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-03)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "2724ece1-3255-42a1-a1dd-fa2144611af3", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-02-06T03:13:45Z", "date_only": false, "value": "2025-02-06T03:13:45.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "7819abcd-ae6a-492c-8adf-71d0b2c09f57"}, {"timestamp": "2025-02-23T04:10:36Z", "date_only": false, "value": "2025-02-23T04:10:36.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "fb25cb88-cd7a-4464-958d-8b76105771a1"}, {"timestamp": "2025-03-18T00:00:00Z", "date_only": false, "value": "2025-03-18T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-18)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "aefe01d5-eb84-4e41-8276-842772bbc14a", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-04-28T00:00:00Z", "date_only": false, "value": "2025-04-28T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-27850", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "36634e60-874e-457d-b185-277699e51b43", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-04-28T00:00:00Z", "date_only": false, "value": "2025-04-28T00:00:00.000Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-27850", "field": "evidence.0.details.added_date", "uuid": "36634e60-874e-457d-b185-277699e51b43", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-04-28T00:00:00Z", "date_only": false, "value": "2025-04-28T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-28)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "b66ca51a-68f4-425d-9bd8-ad1a2ab75d53", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-04-28T00:00:00Z", "date_only": false, "value": "2025-04-28T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-27850", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "36634e60-874e-457d-b185-277699e51b43", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-04-28T00:00:00Z", "date_only": false, "value": "2025-04-28T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-27850", "field": "status.status_updated_at", "uuid": "36634e60-874e-457d-b185-277699e51b43", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-05-22T00:00:00Z", "date_only": false, "value": "2025-05-22T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-22)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "2fad3752-9d40-4649-9e94-5013227fdf56", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-06-11T00:00:00Z", "date_only": false, "value": "2025-06-11T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-11)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "11db9cf3-fef5-4205-8291-aa2c36db862e", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-06-23T00:00:00Z", "date_only": false, "value": "2025-06-23T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-23)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "f62ae3bb-e4e5-4113-b252-ea0ba1cde810", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-11-28T00:00:00Z", "date_only": false, "value": "2025-11-28T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-28)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "74944d92-ba66-4ffa-bd80-8b15bfa5e3fd", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-12-05T00:00:00Z", "date_only": false, "value": "2025-12-05T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-05)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "a07b2514-74ac-42d2-a5e5-7986795952ed", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-12-09T00:00:00Z", "date_only": false, "value": "2025-12-09T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-09)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "4df4ef31-9aa2-436c-b1c5-d70e0a9c3e06", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-12-14T00:00:00Z", "date_only": false, "value": "2025-12-14T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-14)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "9f6e0da5-96c2-43fc-b278-40b0af182775", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-12-15T00:00:00Z", "date_only": false, "value": "2025-12-15T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-15)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "6e637480-1cf1-4e98-bf81-d0db8ed711da", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-12-20T00:00:00Z", "date_only": false, "value": "2025-12-20T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-20)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "6fa5ed46-d6cc-4ca1-8418-c5cf90a65cff", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2025-12-31T00:00:00Z", "date_only": false, "value": "2025-12-31T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-31)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "190391ea-4fe5-46aa-927e-3e3261c58b53", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-01-10T00:00:00Z", "date_only": false, "value": "2026-01-10T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-10)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "db57466a-3cca-455f-97d4-251923789a3a", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-01-28T00:00:00Z", "date_only": false, "value": "2026-01-28T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-28)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "13735ee2-cf19-43c3-8efc-8a6199aa653d", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-02-11T00:00:00Z", "date_only": false, "value": "2026-02-11T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-11)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "01dc0a84-161f-4e95-b560-fa792438adf3", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-03-01T00:00:00Z", "date_only": false, "value": "2026-03-01T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-01)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "27548d73-9090-4f3e-a2f9-8cbbe626769d", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-03-22T00:00:00Z", "date_only": false, "value": "2026-03-22T00:00:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-22)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "0af124bc-9221-4150-96af-faf4c90e3aa3", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-17T03:45:30.777Z", "date_only": false, "value": "2026-06-17T03:45:30.777", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-27850", "record": "FKIE_CVE-2021-27850", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-06-19T12:46:17.890Z", "date_only": false, "value": "2026-06-19T12:46:17.890763Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4b88f874-9ed8-4046-af05-6923d69e8e6e", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "bdb7a70e-4f66-46d7-a16f-412f0cb35815", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4b88f874-9ed8-4046-af05-6923d69e8e6e", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T11:11:17Z", "date_only": false, "value": "2026-06-23T11:11:17+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-27850", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "36634e60-874e-457d-b185-277699e51b43", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-23T11:13:06.476Z", "date_only": false, "value": "2026-06-23T11:13:06.476940Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/36634e60-874e-457d-b185-277699e51b43", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "94e56626-29cd-4679-98d6-07bf3ebb9e7c", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/36634e60-874e-457d-b185-277699e51b43", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-23T14:04:25.583Z", "date_only": false, "value": "2026-06-23T14:04:25.583440Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f0da9e81-d45f-4f65-be6a-fd4af53b9c04", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "7885032e-e71b-4ed8-8256-841ff1963ed1", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f0da9e81-d45f-4f65-be6a-fd4af53b9c04", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-06-30T09:22:49.959Z", "date_only": false, "value": "2026-06-30T09:22:49.959186Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/db98cb31-36f0-4d78-9ea0-7ccabb3bbf8c", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "95cd343c-2412-4c69-9501-a72af30657db", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/db98cb31-36f0-4d78-9ea0-7ccabb3bbf8c", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-01T05:54:50.923Z", "date_only": false, "value": "2026-07-01T05:54:50.923577Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/3809cc80-3dbf-4b00-8a06-62028854b045", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "dc0046ab-8fb2-49bc-a3ba-32362dc6a4b5", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/3809cc80-3dbf-4b00-8a06-62028854b045", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-17T10:15:07.855Z", "date_only": false, "value": "2026-07-17T10:15:07.855671Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-16)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "ba59d1d8-4e14-48ed-af08-601d25920008", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-01T17:00:47.094Z", "date_only": false, "value": "2026-09-01T17:00:47.094867Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cissp/3562", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "fc216869-1c6e-459b-b060-cdc9b02fffd9", "url": "https://t.me/cissp/3562"}, {"timestamp": "2026-09-01T20:02:33.817Z", "date_only": false, "value": "2026-09-01T20:02:33.817993Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/15675", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "5bacb73e-3991-4872-be02-1f20aeb816e7", "url": "https://t.me/hacking_Attack/15675"}, {"timestamp": "2026-09-02T01:00:04.128Z", "date_only": false, "value": "2026-09-02T01:00:04.128274Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/5XKanLqzndKTp87szQTPMzuzxyafZxrYjGI4eXPkJHPBONs", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "0b06505a-1e19-43b8-8ccc-9cff01fa526e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-02T01:00:17.238Z", "date_only": false, "value": "2026-09-02T01:00:17.238116Z", "kind": "sighting", "label": "Seen", "source": "Telegram/23aKnIFlZBB8r0V68doIAMfGKCLJusz1ZVEh5vrmpx1x9Pc", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "a9938d40-c16c-4d1b-9dd3-ffd1d3d1d7eb"}, {"timestamp": "2026-09-03T00:00:38.724Z", "date_only": false, "value": "2026-09-03T00:00:38.724022Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/23aKnIFlZBB8r0V68doIAMfGKCLJusz1ZVEh5vrmpx1x9Pc", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "1d3c6ffa-47a9-4009-9fbd-953ba43888b9", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-07T10:15:12.021Z", "date_only": false, "value": "2026-09-07T10:15:12.021304Z", "kind": "sighting", "label": "Exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-09-06)", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "2599813a-c982-4224-a0de-205bc5d28764", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-08T00:00:07.834Z", "date_only": false, "value": "2026-09-08T00:00:07.834685Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/15675", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "fbf6c04e-edcd-45a2-b128-f2c72b77714c", "url": "https://t.me/hacking_Attack/15675", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-11T03:00:05.062Z", "date_only": false, "value": "2026-09-11T03:00:05.062678Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cissp/3562", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "7e436bf2-dc47-4c6c-b450-0fd778442e5e", "url": "https://t.me/cissp/3562", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2021-27850", "field": "timestamps.last_seen_at", "uuid": "3809cc80-3dbf-4b00-8a06-62028854b045", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": true, "value": "2026-11-09", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2021-27850", "field": "evidence.0.details.observation_date", "uuid": "3809cc80-3dbf-4b00-8a06-62028854b045", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-09T00:00:00Z", "date_only": false, "value": "2026-11-09T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2021-27850", "field": "status.status_updated_at", "uuid": "3809cc80-3dbf-4b00-8a06-62028854b045", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-11-11T01:00:01Z", "date_only": false, "value": "2026-11-11T01:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2021-27850", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "batch_listing": true, "uuid": "3809cc80-3dbf-4b00-8a06-62028854b045", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-11T09:05:24.233Z", "anchors": {"origin": {"timestamp": "2021-04-15T07:40:11Z", "date_only": false, "value": "2021-04-15T07:40:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-27850", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2021-04-15T07:40:11Z", "date_only": false, "value": "2021-04-15T07:40:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-27850", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2021-06-26T13:47:51Z", "date_only": false, "value": "2021-06-26T13:47:51.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/3694", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "96e91f2b-f48c-4a92-bd2e-333e2b07f4da", "content": "#exploit\nA PoC for CVE-2021-27850\naffecting Apache Tapestry and leading to unauthencticated RCE\nhttps://github.com/kahla-sec/CVE-2021-27850_POC", "url": "https://t.me/CyberSecurityTechnologies/3694", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2023-10-14T14:56:55Z", "date_only": false, "value": "2023-10-14T14:56:55+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2021-27850", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "batch_listing": true, "uuid": "3809cc80-3dbf-4b00-8a06-62028854b045", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 78823004.0, "hours": 21895.27888888889, "days": 912.3032870370371, "min_seconds": 78823004.0, "max_seconds": 78823004.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": true, "end_before_start": false, "start": {"timestamp": "2021-04-15T07:40:11Z", "date_only": false, "value": "2021-04-15T07:40:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-27850", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2023-10-14T14:56:55Z", "date_only": false, "value": "2023-10-14T14:56:55+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2021-27850", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "batch_listing": true, "uuid": "3809cc80-3dbf-4b00-8a06-62028854b045", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 78823004.0, "hours": 21895.27888888889, "days": 912.3032870370371, "min_seconds": 78823004.0, "max_seconds": 78823004.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": true, "end_before_start": false, "start": {"timestamp": "2021-04-15T07:40:11Z", "date_only": false, "value": "2021-04-15T07:40:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-27850", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2023-10-14T14:56:55Z", "date_only": false, "value": "2023-10-14T14:56:55+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2021-27850", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "batch_listing": true, "uuid": "3809cc80-3dbf-4b00-8a06-62028854b045", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 6242860.0, "hours": 1734.1277777777777, "days": 72.25532407407407, "min_seconds": 6242860.0, "max_seconds": 6242860.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-04-15T07:40:11Z", "date_only": false, "value": "2021-04-15T07:40:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-27850", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2021-06-26T13:47:51Z", "date_only": false, "value": "2021-06-26T13:47:51.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/3694", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "96e91f2b-f48c-4a92-bd2e-333e2b07f4da", "content": "#exploit\nA PoC for CVE-2021-27850\naffecting Apache Tapestry and leading to unauthencticated RCE\nhttps://github.com/kahla-sec/CVE-2021-27850_POC", "url": "https://t.me/CyberSecurityTechnologies/3694", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 175915513.233682, "hours": 48865.420342689446, "days": 2036.0591809453936, "min_seconds": 175915513.233682, "max_seconds": 175915513.233682, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-04-15T07:40:11Z", "date_only": false, "value": "2021-04-15T07:40:11.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2021-27850", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T09:05:24.233Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 97092509.233682, "hours": 26970.141453800556, "days": 1123.7558939083565, "min_seconds": 97092509.233682, "max_seconds": 97092509.233682, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": true, "end_before_start": false, "start": {"timestamp": "2023-10-14T14:56:55Z", "date_only": false, "value": "2023-10-14T14:56:55+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2021-27850", "field": "timestamps.first_seen_at", "metric_role": "exploitation", "metric_basis": "kev_first_seen", "batch_listing": true, "uuid": "3809cc80-3dbf-4b00-8a06-62028854b045", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-11T09:05:24.233Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 169672653.233682, "hours": 47131.292564911666, "days": 1963.8038568713196, "min_seconds": 169672653.233682, "max_seconds": 169672653.233682, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2021-06-26T13:47:51Z", "date_only": false, "value": "2021-06-26T13:47:51.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/3694", "record": "CVE-2021-27850", "field": "creation_timestamp", "uuid": "96e91f2b-f48c-4a92-bd2e-333e2b07f4da", "content": "#exploit\nA PoC for CVE-2021-27850\naffecting Apache Tapestry and leading to unauthencticated RCE\nhttps://github.com/kahla-sec/CVE-2021-27850_POC", "url": "https://t.me/CyberSecurityTechnologies/3694", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T09:05:24.233Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}