CVE-2021-42560 An issue was discovered in CALDERA 2.9.0.

What is CVE-2021-42560?

CVE-2021-42560 is a high-severity vulnerability in n/a, published on 12 Jan 2022.

Official description

An issue was discovered in CALDERA 2.9.0. The Debrief plugin receives base64 encoded "SVG" parameters when generating a PDF document. These SVG documents are parsed in an unsafe manner and can be leveraged for XXE attacks (e.g., File Exfiltration, Server Side Request Forgery, Out of Band Exfiltration, etc.).

Weakness: CWE-611

Which versions are affected by CVE-2021-42560?

It affects 1 product.

Products include Mitre Caldera.

How do I fix CVE-2021-42560?

No fix has been published for CVE-2021-42560 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-42560 being exploited?

There is no known exploitation of CVE-2021-42560 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2021-42559 Command injection in n/a High 8.8
• CVE-2021-42561 Command injection in n/a High 8.8
• CVE-2020-19907 Command injection in n/a High 8.8
• CVE-2021-42562 Missing authorization in n/a High 8.1
• CVE-2022-40605 Cross-site scripting in n/a Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c676-8v9r-pxgj.