CVE-2021-41790

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-41790

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41790.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-41790

Published

2021-10-21T09:15:08.790Z

Modified

2026-07-08T06:00:43.302654382Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allows executing scripts uploaded outside of the Data Dictionary. This could allow a logged-in attacker to execute arbitrary code inside a sandboxed environment.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.0.0.0"
                },
                {
                    "last_affected": "5.2.7.11"
                }
            ],
            "cpes": [
                "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:enterprise:*:*:*"
            ],
            "source": "CPE_RANGE",
            "vendor_product": "alfresco:alfresco_content_services"
        }
    ]
}

References

Affected packages

Git / github.com/alfresco/acs-packaging

Affected ranges

Type

GIT

Repo

https://github.com/alfresco/acs-packaging

Events

Introduced

Last affected

e9bae6e3c6af20208a697b7ef4e5f110dd56a7c4

Last affected

8ea44bf3922ae822e2d24bbdd2228d40bd4a329d

Last affected

ea5589d79b32f9e9f8087d4c7c2662c5a76b9b56

Last affected

8a40491d57bb13b63e8b44c90f3f34862c218515

Introduced

d1378318882c7158649adbf6188758c2e366e33f

Last affected

99eb094d4fa2b75cd736555d8cd8dec05bea5813

Database specific

{
    "cpe": [
        "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:alfresco:alfresco_content_services:7.0:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:alfresco:alfresco_content_services:7.0.0.1:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:alfresco:alfresco_content_services:7.0.0.2:*:*:*:enterprise:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "6.0.0.0"
        },
        {
            "last_affected": "6.0.1.9"
        },
        {
            "introduced": "6.1.0.0"
        },
        {
            "last_affected": "6.1.1.10"
        },
        {
            "introduced": "6.2.0.0"
        },
        {
            "last_affected": "6.2.2.18"
        },
        {
            "introduced": "7.0.1.0"
        },
        {
            "last_affected": "7.0.1.2"
        },
        {
            "introduced": "7.0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "introduced": "7.0.0.1"
        },
        {
            "last_affected": "7.0.0.1"
        },
        {
            "introduced": "7.0.0.2"
        },
        {
            "last_affected": "7.0.0.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

6.*

6.0.1.7

6.0.1.8

6.0.1.9

6.1.1.10

6.1.1.8

6.1.1.9

6.2.2.10

6.2.2.11

6.2.2.12

6.2.2.13

6.2.2.14

6.2.2.15

6.2.2.16

6.2.2.17

6.2.2.18

6.2.2.4

6.2.2.5

6.2.2.6

6.2.2.7

6.2.2.8

6.2.2.9

7.*

7.0

7.0.0

7.0.0.1

7.0.0.2

7.0.1

7.0.1-A1

7.0.1-A4

7.0.1-A5

7.0.1-A6

7.0.1.1

7.0.1.2

acs-packaging-6.*

acs-packaging-6.0.0

acs-packaging-6.0.0-EA1

acs-packaging-6.0.0-RC1

acs-packaging-6.0.0-RC2

acs-packaging-6.0.0-RC3

acs-packaging-6.0.0-RC4

acs-packaging-6.0.0-RC5

acs-packaging-6.0.0-RC6

acs-packaging-6.0.0-testRC3

acs-packaging-6.0.0-testRc4

acs-packaging-6.0.0-testRc6

acs-packaging-6.0.0-testRc7

acs-packaging-6.0.1

acs-packaging-6.0.1.1

acs-packaging-6.0.1.1-RC1

acs-packaging-6.0.1.2

acs-packaging-6.0.1.3

acs-packaging-6.0.1.4

acs-packaging-6.0.1.5

acs-packaging-6.0.1.6

acs-packaging-6.1.0-A1

acs-packaging-6.1.0-A2

acs-packaging-6.1.0-EA1

acs-packaging-6.1.0-EA2

acs-packaging-6.1.0-EA3

acs-packaging-6.1.0-RC2

acs-packaging-6.1.1

acs-packaging-6.1.1-RC1

acs-packaging-6.1.1-RC2

acs-packaging-6.1.1-RC3

acs-packaging-6.1.1.1

acs-packaging-6.1.1.2

acs-packaging-6.1.1.3

acs-packaging-6.1.1.4

acs-packaging-6.2.0-A1

acs-packaging-6.2.0-A2

acs-packaging-6.2.0-A3

acs-packaging-6.2.0-A4

acs-packaging-6.2.0-A5

acs-packaging-6.2.0-A6

acs-packaging-6.2.0-A7

acs-packaging-6.2.0-A8

acs-packaging-6.2.0-RC1

acs-packaging-6.2.0-RC2

acs-packaging-6.2.0-RC3

acs-packaging-6.2.1-A1

acs-packaging-6.2.1-A2

acs-packaging-6.2.1-A3

acs-packaging-6.2.1-A4

acs-packaging-6.2.1-RC1

acs-packaging-6.2.1-RC2

acs-packaging-6.2.1-RC3

acs-packaging-6.2.1-RC4

acs-packaging-6.2.1-RC5

acs-packaging-6.2.1-RC6

acs-packaging-6.2.2

acs-packaging-6.2.2-A1

acs-packaging-6.2.2-A2

acs-packaging-6.2.2-RC1

acs-packaging-6.2.2.1

acs-packaging-6.2.2.2

acs-packaging-6.3.0-A1

acs-packaging-6.3.0-A10

acs-packaging-6.3.0-A11

acs-packaging-6.3.0-A3

acs-packaging-6.3.0-A4

acs-packaging-6.3.0-A5

acs-packaging-6.3.0-A7

acs-packaging-6.3.0-A8

acs-packaging-6.3.0-A9

acs-packaging-7.*

acs-packaging-7.0.0-A1

acs-packaging-7.0.0-A2

acs-packaging-7.0.0-A3

acs-packaging-7.0.0-A4

acs-packaging-7.0.0-A5

acs-packaging-7.0.0-A6

acs-packaging-7.0.0-A7

acs-packaging-7.0.0-A8

acs-packaging-7.0.0-M1

acs-packaging-7.0.0-M2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41790.json"