CVE-2021-38147: Wipro Holmes Orchestrator unauthenticated report file download

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated remote disclosure of sensitive reports including domain credentials, with a public exploit reference and very high EPSS, though not in KEV.

What it is

Wipro Holmes Orchestrator 20.4.1 exposes several DownloadExcelFile API endpoints (Domain_Credential_Report_Excel, User_Report_Excel, Process_Report_Excel, Infrastructure_Report_Excel, Resolver_Report_Excel) that require no authentication. A remote attacker can request these endpoints and download arbitrary report files, including ones containing sensitive information such as domain credentials.

Impact

An attacker gains unauthenticated read access to generated reports, which can expose domain credentials and other sensitive operational data. The CVSS vector confirms high confidentiality impact with no integrity or availability effect.

Attack surface

Reachable over the network via HTTP requests to the processexecution/DownloadExcelFile/... API paths; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but a public Packet Storm exploit reference exists and EPSS is very high (0.53, ~98.9th percentile), indicating elevated likelihood of exploitation.

What to do

• Apply the vendor fix or upgrade Holmes Orchestrator beyond 20.4.1 if Wipro provides one; the record does not state a fixed version, so confirm with the vendor.
• Restrict network access to the Holmes Orchestrator API so only trusted management networks can reach it.
• Require authentication and authorization on the DownloadExcelFile endpoints at a reverse proxy or gateway if the application cannot be patched immediately.
• Remove or relocate sensitive report content such as domain credential reports and limit what those reports contain.
• Monitor and rotate any credentials that may have been exposed through these reports.

Detection

• Search web/proxy logs for unauthenticated GET requests to processexecution/DownloadExcelFile/ paths, especially the five named report endpoints.
• Alert on access to Domain_Credential_Report_Excel or User_Report_Excel from unexpected source IPs or outside normal admin networks.
• Baseline normal report download clients and flag new or anomalous user agents and source addresses hitting these endpoints.
• Correlate any successful downloads with subsequent authentication attempts or credential use from the same source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.