CVE-2021-41792
Last modified
CVE-2021-41792 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. EPSS estimates a 0.83% chance of exploitation in the next 30 days.
Description
An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to the attacker, i.e., this is blind SSRF.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Alfresco | Alfresco Content Services | >= 5.0.0.0, <= 5.2.7.11 |
| Alfresco | Alfresco Content Services | >= 6.0.0.0, <= 6.0.1.9 |
| Alfresco | Alfresco Content Services | >= 6.1.1.0, <= 6.1.1.10 |
| Alfresco | Alfresco Content Services | >= 6.2.0.0, <= 6.2.2.18 |
| Alfresco | Alfresco Transform Services | <= 1.3 |
References
- https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.mdThird Party Advisory
- https://www.themissinglink.com.au/Third Party Advisory
- https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.mdThird Party Advisory
- https://www.themissinglink.com.au/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-41792?
How severe is CVE-2021-41792?
How do I fix CVE-2021-41792?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-41785Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and…7.8
- CVE-2021-41788MediaTek microchips, as used in NETGEAR devices through 2021…7.5
- CVE-2021-41789In wifi driver, there is a possible system crash due to a mi…6.5
- CVE-2021-4179livehelperchat is vulnerable to Improper Neutralization of I…5.4
- CVE-2021-41790An issue was discovered in Hyland org.alfresco:alfresco-cont…8.8
- CVE-2021-41791An issue was discovered in Hyland org.alfresco:share through…5.4
- CVE-2021-41794ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriatel…7.5
- CVE-2021-41795The Safari app extension bundled with 1Password for Mac 7.7.…6.5
- CVE-2021-41796Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-41797Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-41798MediaWiki before 1.36.2 allows XSS. Month related MediaWiki …6.1
- CVE-2021-41799MediaWiki before 1.36.2 allows a denial of service (resource…7.5
Are you affected by CVE-2021-41792?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST