CVE-2021-41790

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-41790

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41790.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-41790

Published

2021-10-21T09:15:08Z

Modified

2026-10-24T02:47:25Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allows executing scripts uploaded outside of the Data Dictionary. This could allow a logged-in attacker to execute arbitrary code inside a sandboxed environment.

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:enterprise:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "5.0.0.0"
                        },
                        {
                            "last_affected":  "5.2.7.11"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "alfresco:alfresco_content_services"
        }
    ]
}

References

Affected packages

Git / github.com/alfresco/acs-packaging

Affected ranges

Type

GIT

Repo

https://github.com/alfresco/acs-packaging

Events

Introduced

Last Affected

e9bae6e3c6af20208a697b7ef4e5f110dd56a7c4

Last Affected

8ea44bf3922ae822e2d24bbdd2228d40bd4a329d

Last Affected

ea5589d79b32f9e9f8087d4c7c2662c5a76b9b56

Last Affected

8a40491d57bb13b63e8b44c90f3f34862c218515

Introduced

d1378318882c7158649adbf6188758c2e366e33f

Last Affected

99eb094d4fa2b75cd736555d8cd8dec05bea5813

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:enterprise:*:*:*",
            "range":  [
                {
                    "introduced":  "6.0.0.0"
                },
                {
                    "last_affected":  "6.0.1.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:enterprise:*:*:*",
            "range":  [
                {
                    "introduced":  "6.1.0.0"
                },
                {
                    "last_affected":  "6.1.1.10"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:enterprise:*:*:*",
            "range":  [
                {
                    "introduced":  "6.2.0.0"
                },
                {
                    "last_affected":  "6.2.2.18"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:enterprise:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.1.0"
                },
                {
                    "last_affected":  "7.0.1.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:alfresco:alfresco_content_services:7.0:*:*:*:enterprise:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0"
                },
                {
                    "last_affected":  "7.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:alfresco:alfresco_content_services:7.0.0.1:*:*:*:enterprise:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0.1"
                },
                {
                    "last_affected":  "7.0.0.1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:alfresco:alfresco_content_services:7.0.0.2:*:*:*:enterprise:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0.2"
                },
                {
                    "last_affected":  "7.0.0.2"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

6.*

6.0.1.7

6.0.1.8

6.0.1.9

6.1.1.10

6.1.1.8

6.1.1.9

6.2.2.10

6.2.2.11

6.2.2.12

6.2.2.13

6.2.2.14

6.2.2.15

6.2.2.16

6.2.2.17

6.2.2.18

6.2.2.4

6.2.2.5

6.2.2.6

6.2.2.7

6.2.2.8

6.2.2.9

7.*

7.0

7.0.0

7.0.0.1

7.0.0.2

7.0.1

7.0.1-A1

7.0.1-A4

7.0.1-A5

7.0.1-A6

7.0.1.1

7.0.1.2

acs-packaging-6.*

acs-packaging-6.0.0

acs-packaging-6.0.0-EA1

acs-packaging-6.0.0-RC1

acs-packaging-6.0.0-RC2

acs-packaging-6.0.0-RC3

acs-packaging-6.0.0-RC4

acs-packaging-6.0.0-RC5

acs-packaging-6.0.0-RC6

acs-packaging-6.0.0-testRC3

acs-packaging-6.0.0-testRc4

acs-packaging-6.0.0-testRc6

acs-packaging-6.0.0-testRc7

acs-packaging-6.0.1

acs-packaging-6.0.1.1

acs-packaging-6.0.1.1-RC1

acs-packaging-6.0.1.2

acs-packaging-6.0.1.3

acs-packaging-6.0.1.4

acs-packaging-6.0.1.5

acs-packaging-6.0.1.6

acs-packaging-6.1.0-A1

acs-packaging-6.1.0-A2

acs-packaging-6.1.0-EA1

acs-packaging-6.1.0-EA2

acs-packaging-6.1.0-EA3

acs-packaging-6.1.0-RC2

acs-packaging-6.1.1

acs-packaging-6.1.1-RC1

acs-packaging-6.1.1-RC2

acs-packaging-6.1.1-RC3

acs-packaging-6.1.1.1

acs-packaging-6.1.1.2

acs-packaging-6.1.1.3

acs-packaging-6.1.1.4

acs-packaging-6.2.0-A1

acs-packaging-6.2.0-A2

acs-packaging-6.2.0-A3

acs-packaging-6.2.0-A4

acs-packaging-6.2.0-A5

acs-packaging-6.2.0-A6

acs-packaging-6.2.0-A7

acs-packaging-6.2.0-A8

acs-packaging-6.2.0-RC1

acs-packaging-6.2.0-RC2

acs-packaging-6.2.0-RC3

acs-packaging-6.2.1-A1

acs-packaging-6.2.1-A2

acs-packaging-6.2.1-A3

acs-packaging-6.2.1-A4

acs-packaging-6.2.1-RC1

acs-packaging-6.2.1-RC2

acs-packaging-6.2.1-RC3

acs-packaging-6.2.1-RC4

acs-packaging-6.2.1-RC5

acs-packaging-6.2.1-RC6

acs-packaging-6.2.2

acs-packaging-6.2.2-A1

acs-packaging-6.2.2-A2

acs-packaging-6.2.2-RC1

acs-packaging-6.2.2.1

acs-packaging-6.2.2.2

acs-packaging-6.3.0-A1

acs-packaging-6.3.0-A10

acs-packaging-6.3.0-A11

acs-packaging-6.3.0-A3

acs-packaging-6.3.0-A4

acs-packaging-6.3.0-A5

acs-packaging-6.3.0-A7

acs-packaging-6.3.0-A8

acs-packaging-6.3.0-A9

acs-packaging-7.*

acs-packaging-7.0.0-A1

acs-packaging-7.0.0-A2

acs-packaging-7.0.0-A3

acs-packaging-7.0.0-A4

acs-packaging-7.0.0-A5

acs-packaging-7.0.0-A6

acs-packaging-7.0.0-A7

acs-packaging-7.0.0-A8

acs-packaging-7.0.0-M1

acs-packaging-7.0.0-M2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41790.json"