« Volver al listado

CVE-2021-41792

Estado: ModificadaMedia (5.3)—

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to the attacker, i.e., this is blind SSRF.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Alfresco — Alfresco Content ServicesAlfresco — Alfresco Transform Services

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-41792",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-21T09:15:08.913",
  "references": [
    {
      "url": "https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.themissinglink.com.au/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/Alfresco/acs-packaging/blob/master/DISCLOSURES.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.themissinglink.com.au/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to the attacker, i.e., this is blind SSRF."
    },
    {
      "lang": "es",
      "value": "Se ha detectado un problema en Hyland org.alfresco:alfresco-content-services versiones hasta 6.2.2.18 y org.alfresco:alfresco-transform-services versiones hasta 1.3. Un archivo HTML diseñado, una vez cargado, podría desencadenar una petición inesperada por parte del motor de transformación. La respuesta a la petición no está disponible para el atacante, es decir, se trata de una vulnerabilidad de tipo SSRF ciega"
    }
  ],
  "lastModified": "2026-06-17T04:08:55.557",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34065850-B18B-4083-B8D5-BD3928E9DD26",
              "versionEndIncluding": "5.2.7.11",
              "versionStartIncluding": "5.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47B1B080-B568-4B91-8662-F9BEF0195A10",
              "versionEndIncluding": "6.0.1.9",
              "versionStartIncluding": "6.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C749461B-1F26-49EA-95DD-AD7FEA1A88E9",
              "versionEndIncluding": "6.1.1.10",
              "versionStartIncluding": "6.1.1.0"
            },
            {
              "criteria": "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64E84F1C-725C-4D15-95FB-6B27B6C35BE3",
              "versionEndIncluding": "6.2.2.18",
              "versionStartIncluding": "6.2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:alfresco:alfresco_transform_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0B22857-863D-4AAA-ADE7-DCD7119961EE",
              "versionEndIncluding": "1.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}