CVE-2021-47724: STVS ProVision Authenticated File Disclosure via archive.rb

Security readout for executives and security teams

CVE-2021-47724 lets a logged-in user of STVS ProVision 5.9.10 read files outside the intended archive download area. This can expose sensitive server files and configuration data. It requires authentication, but the attack is low-complexity and public exploit information exists. No source provided confirms active exploitation. Exposure is limited to organizations running STVS ProVision 5.9.10 build 2885-3a8219a, especially where authenticated users can reach the archive download feature over a network. The CVE record lists other versions as unaffected by default, but administrators should confirm their deployed version and vendor status. Treat as a high-priority exposure if ProVision 5.9.10 is deployed. The issue can disclose sensitive server files and has public exploit information, but requires authentication and lacks confirmed active exploitation in the provided sources. Prioritize asset identification, vendor guidance, and access restriction. Mitigation focus: Identify any STVS ProVision 5.9.10 build 2885-3a8219a deployments.; Check STVS or trusted advisory sources for official fix or upgrade guidance.; Restrict ProVision access to trusted networks and authorized users only..

Prepared

Apr 30, 2026, 03:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.