CVE-2021-21938 - OpenCVE

A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Accusoft	Imagegear

Configuration 1 [-]

cpe:2.3:a:accusoft:imagegear:19.10:*:*:*:*:*:*:*

References

Link	Resource
http://help.accusoft.com/ImageGear/v20.0/Windows/DLL/webframe.html	Product
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1367	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: talos

Published: 2022-02-23T00:00:00

Updated: 2023-03-17T14:50:27.500Z

Reserved: 2021-01-04T00:00:00

Link: CVE-2021-21938

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-04-14T20:15:08.157

Modified: 2023-06-26T18:00:43.433

Link: CVE-2021-21938

JSON object: View

Redhat Information

No data.

CWE

CWE-193

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:accusoft:imagegear:19.10:*:*:*:*:*:*:*", "matchCriteriaId": "5E12FA77-4A14-4F3B-9505-E0E5402C3011", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de desbordamiento de b\u00fafer en la regi\u00f3n heap de la memoria en la funcionalidad del analizador Palette box de Accusoft ImageGear versi\u00f3n 19.10. Un archivo especialmente dise\u00f1ado puede conllevar a una ejecuci\u00f3n de c\u00f3digo. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad"}], "id": "CVE-2021-21938", "lastModified": "2023-06-26T18:00:43.433", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "talos-cna@cisco.com", "type": "Secondary"}]}, "published": "2022-04-14T20:15:08.157", "references": [{"source": "talos-cna@cisco.com", "tags": ["Product"], "url": "http://help.accusoft.com/ImageGear/v20.0/Windows/DLL/webframe.html"}, {"source": "talos-cna@cisco.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1367"}], "sourceIdentifier": "talos-cna@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-193"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-193"}], "source": "talos-cna@cisco.com", "type": "Secondary"}]}