« Back to list

CVE-2021-44448

Status: ModifiedLow (3.3)—

A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products is vulnerable to an out of bounds read past the end of an allocated buffer when parsing JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14843, ZDI-CAN-15051)

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

Siemens — JT Open ToolkitSiemens — JT Utilities

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2021-44448",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "JT Utilities",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V13.0.3.0"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "JTTK",
          "versions": [
            {
              "status": "affected",
              "version": "All versions <  V11.0.3.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-12-14T12:15:11.877",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-352143.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0). JTTK library in affected products is vulnerable to an out of bounds read past the end of an allocated buffer when parsing JT files. An attacker could leverage this vulnerability to leak information in the context of the current process. (ZDI-CAN-14843, ZDI-CAN-15051)"
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en JT Utilities (Todas las versiones anteriores a V13.0.3.0), JTTK (Todas las versiones anteriores a V11.0.3.0). La biblioteca JTTK en los productos afectados es vulnerable a una lectura fuera de límites más allá del final de un búfer asignado al analizar archivos JT. Un atacante podría aprovechar esta vulnerabilidad para filtrar información en el contexto del proceso actual. (ZDI-CAN-14843, ZDI-CAN-15051)"
    }
  ],
  "lastModified": "2026-06-17T04:12:21.953",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:jt_open_toolkit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A53600FE-086F-492A-8773-223F67952903",
              "versionEndExcluding": "11.0.3.0"
            },
            {
              "criteria": "cpe:2.3:a:siemens:jt_utilities:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E920CC1-8575-470B-9EF0-C9E5BB30B7AF",
              "versionEndExcluding": "13.0.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}