CVE-2021-41792

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-41792

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41792.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-41792

Published

2021-10-21T09:15:08.913Z

Modified

2026-07-08T06:00:34.436667916Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to the attacker, i.e., this is blind SSRF.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "introduced": "5.0.0.0"
                },
                {
                    "last_affected": "5.2.7.11"
                }
            ],
            "vendor_product": "alfresco:alfresco_content_services"
        },
        {
            "cpes": [
                "cpe:2.3:a:alfresco:alfresco_transform_services:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE",
            "vendor_product": "alfresco:alfresco_transform_services",
            "extracted_events": [
                {
                    "last_affected": "1.3"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/alfresco/acs-packaging

Affected ranges

Type

GIT

Repo

https://github.com/alfresco/acs-packaging

Events

Introduced

Last affected

e9bae6e3c6af20208a697b7ef4e5f110dd56a7c4

Last affected

8ea44bf3922ae822e2d24bbdd2228d40bd4a329d

Last affected

ea5589d79b32f9e9f8087d4c7c2662c5a76b9b56

Database specific

{
    "cpe": "cpe:2.3:a:alfresco:alfresco_content_services:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "6.0.0.0"
        },
        {
            "last_affected": "6.0.1.9"
        },
        {
            "introduced": "6.1.1.0"
        },
        {
            "last_affected": "6.1.1.10"
        },
        {
            "introduced": "6.2.0.0"
        },
        {
            "last_affected": "6.2.2.18"
        }
    ]
}

Affected versions

6.*

6.0.1.7

6.0.1.8

6.0.1.9

6.1.1.10

6.1.1.8

6.1.1.9

6.2.2.10

6.2.2.11

6.2.2.12

6.2.2.13

6.2.2.14

6.2.2.15

6.2.2.16

6.2.2.17

6.2.2.18

6.2.2.4

6.2.2.5

6.2.2.6

6.2.2.7

6.2.2.8

6.2.2.9

acs-packaging-6.*

acs-packaging-6.0.0

acs-packaging-6.0.0-EA1

acs-packaging-6.0.0-RC1

acs-packaging-6.0.0-RC2

acs-packaging-6.0.0-RC3

acs-packaging-6.0.0-RC4

acs-packaging-6.0.0-RC5

acs-packaging-6.0.0-RC6

acs-packaging-6.0.0-testRC3

acs-packaging-6.0.0-testRc4

acs-packaging-6.0.0-testRc6

acs-packaging-6.0.0-testRc7

acs-packaging-6.0.1

acs-packaging-6.0.1.1

acs-packaging-6.0.1.1-RC1

acs-packaging-6.0.1.2

acs-packaging-6.0.1.3

acs-packaging-6.0.1.4

acs-packaging-6.0.1.5

acs-packaging-6.0.1.6

acs-packaging-6.1.0-A1

acs-packaging-6.1.0-A2

acs-packaging-6.1.0-EA1

acs-packaging-6.1.0-EA2

acs-packaging-6.1.0-EA3

acs-packaging-6.1.0-RC2

acs-packaging-6.1.1

acs-packaging-6.1.1-RC1

acs-packaging-6.1.1-RC2

acs-packaging-6.1.1-RC3

acs-packaging-6.1.1.1

acs-packaging-6.1.1.2

acs-packaging-6.1.1.3

acs-packaging-6.1.1.4

acs-packaging-6.2.0-A1

acs-packaging-6.2.0-A2

acs-packaging-6.2.0-A3

acs-packaging-6.2.0-A4

acs-packaging-6.2.0-A5

acs-packaging-6.2.0-A6

acs-packaging-6.2.0-A7

acs-packaging-6.2.0-A8

acs-packaging-6.2.0-RC1

acs-packaging-6.2.0-RC2

acs-packaging-6.2.0-RC3

acs-packaging-6.2.1-A1

acs-packaging-6.2.1-A2

acs-packaging-6.2.1-A3

acs-packaging-6.2.1-A4

acs-packaging-6.2.1-RC1

acs-packaging-6.2.1-RC2

acs-packaging-6.2.1-RC3

acs-packaging-6.2.1-RC4

acs-packaging-6.2.1-RC5

acs-packaging-6.2.1-RC6

acs-packaging-6.2.2

acs-packaging-6.2.2-A1

acs-packaging-6.2.2-A2

acs-packaging-6.2.2-RC1

acs-packaging-6.2.2.1

acs-packaging-6.2.2.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41792.json"