LiveActive security incident?Get immediate response
CVE Record

CVE-2021-32018: An issue was discovered in JUMP AMS 3.6.0.04.009-2487.

An issue was discovered in JUMP AMS 3.6.0.04.009-2487. The JUMP SOAP API was vulnerable to arbitrary file reading due to an improper limitation of file loading on the server filesystem, aka directory traversal.

HighCVSS 8.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-32018 affects JUMP AMS 3.6.0.04.009-2487. A flaw in the JUMP SOAP API could let a low-privileged network user read files from the server through directory traversal. The main business risk is exposure of sensitive server-side files, secrets, or configuration data.

Executive priority

Prioritize this for any environment running the named JUMP AMS version, especially if the SOAP API is reachable beyond tightly controlled admin networks. The risk is sensitive data disclosure rather than system takeover based on the supplied evidence.

Technical view

The vulnerability is an arbitrary file read in the JUMP SOAP API caused by improper limitation of file loading on the server filesystem. The CVSS 3.1 score is 8.5, with network access, low attack complexity, low privileges required, no user interaction, high confidentiality impact, no integrity impact, and low availability impact.

Likely exposure

Exposure is most likely where JUMP AMS 3.6.0.04.009-2487 is deployed and its SOAP API is reachable by low-privileged users over the network. The supplied CVE metadata does not identify broader product versions or CPEs.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The issue is still serious because exploitation requires low privileges and no user interaction, and the impact is direct server-side file disclosure.

Researcher notes

Public metadata names JUMP AMS 3.6.0.04.009-2487 and describes directory traversal in the JUMP SOAP API. Affected product fields in the supplied CVE bundle are incomplete, so version scoping and remediation details should be confirmed from vendor advisories before closure.

Mitigation direction

  • Check Excellium and Thales guidance for vendor-confirmed remediation or upgrade instructions.
  • Restrict JUMP SOAP API access to trusted networks and required users only.
  • Review account permissions for users who can reach the JUMP SOAP API.
  • Monitor for suspicious SOAP API requests involving unexpected file paths.
  • Treat exposed configuration files or secrets as potentially compromised if abuse is suspected.

Validation and detection

  • Inventory JUMP AMS deployments and confirm exact installed versions.
  • Identify whether the JUMP SOAP API is enabled and network-reachable.
  • Review authentication groups allowed to access the SOAP API.
  • Check server and application logs for abnormal file-loading behavior.
  • Confirm whether vendor guidance has been applied on each affected system.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-32018 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AC:L/AV:N/A:L/C:H/I:N/PR:L/S:C/UI:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.5CVSS 3.1HighCVSS:3.1/AC:L/AV:N/A:L/C:H/I:N/PR:L/S:C/UI:N3.14.7Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.5High
CVSS 3.1 vector shape for CVE-2021-32018Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AC:L/AV:N/A:L/C:H/I:N/PR:L/S:C/UI:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.