CVE-2021-34427: Eclipse BIRT unauthenticated JSP file creation and code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, public exploit references and a very high EPSS score make this an urgent remote code execution risk.

What it is

Eclipse BIRT 4.8.0 and earlier allows an attacker to use query parameters to create a JSP file in the current BIRT viewer directory and inject JSP code into the running instance. Because the resulting file is remotely accessible and executed by the server, this is effectively remote code execution against the BIRT deployment.

Impact

An unauthenticated attacker can write and execute arbitrary JSP code on the BIRT server, leading to full compromise of confidentiality, integrity and availability of the host and its data.

Attack surface

Reachable over the network through the BIRT viewer's HTTP interface by supplying crafted query parameters; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.58, ~99th percentile) and multiple references are tagged Exploit, including public Packet Storm and Full Disclosure postings, so working exploit code is publicly available.

What to do

• Upgrade Eclipse BIRT to a version later than 4.8.0 that contains the fix referenced in the Eclipse bug 538142 patch.
• If immediate upgrade is not possible, restrict network access to the BIRT viewer to trusted users and networks.
• Disable or remove the BIRT viewer web application where it is not required.
• Deploy a WAF rule to block query parameters that attempt to write JSP files or path-traversal content to the viewer directory.
• Run the BIRT service with least privilege and make the viewer directory read-only to the service account.

Detection

• Monitor the BIRT viewer directory for newly created or modified .jsp files and alert on unexpected writes.
• Inspect web server and BIRT access logs for requests with query parameters containing JSP filenames, scriptlet markers or path traversal sequences.
• Alert on outbound or child processes spawned by the BIRT/JVM process, which may indicate injected JSP execution.
• Review file integrity monitoring alerts for changes under the BIRT web application deployment path.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.